Hello, I have Splunk events (stacktrace) which have '\n' in them. I want these '\n' to appear as new lines (but not new event).
So for example, currently my event might look like
aaaaa \n bbbbb \n ccccc \n ddddd
I want this event to appear as follows.
aaaaa
bbbbb
ccccc
ddddd
I know we can use rex command for this at search time, but I want the events to be indexed with \n character stored as newline.
How can I do this at index time?
This is generally done in props.conf
on your indexers by setting SHOULD_LINEMERGE = false
(yes, I know that might seem wrong) and LINE_BREAKER
to a very carefully constructed RegEx that determines where to break them apart, for your sourcetype.
Assuming when you say your can do the same at search time using rex mode=sed
option, you can do the same at index-time using SEDCMD option in the props.conf. See this for more details:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Anonymizedata
@arpit_arora, try to take your rex to fields.conf
for configuring multi-value fields using TOKENIZER: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureSplunktoparsemulti-valuefields