Archive

How to use line breaking for sample data?

Path Finder

Hi,

How to use line breaking to break events before TBD, new event starts with TBD.

sample data:

ABC*11*231~
CFFGBPR*DD*1212*Ddf*12333~
TBD*1*3234454*12223355~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
TBD*1*wewe*2344~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~

required output:
event 1

TBD*1*3234454*12223355~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~

event 2

TBD*1*wewe*2344~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~
DFR*ESDFR*5ewewesd112~
dsdd*DD*dd*Ddf*12333~
FTRRD*DFF*455*434*4321~

I tried below stanza, it dint work. Any suggestions?

[  ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=TBD
CHARSET=UTF-8
disabled=false
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @knalla,

Your config works for me, but try this :

[yoursourcetype]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=(\r|\n)TBD 

You can test it out in the gui using add data.

Cheers,
David

View solution in original post

SplunkTrust
SplunkTrust

Hi @knalla,

Your config works for me, but try this :

[yoursourcetype]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
LINE_BREAKER=(\r|\n)TBD 

You can test it out in the gui using add data.

Cheers,
David

View solution in original post

Path Finder

Its working, but its not breaking events if the event start with TBD.

0 Karma