Building for the Splunk Platform

Newline in events


Hello, I have Splunk events (stacktrace) which have '\n' in them. I want these '\n' to appear as new lines (but not new event).

So for example, currently my event might look like

aaaaa \n bbbbb \n ccccc \n ddddd

I want this event to appear as follows.


I know we can use rex command for this at search time, but I want the events to be indexed with \n character stored as newline.

How can I do this at index time?

Tags (1)
0 Karma

Esteemed Legend

This is generally done in props.conf on your indexers by setting SHOULD_LINEMERGE = false (yes, I know that might seem wrong) and LINE_BREAKER to a very carefully constructed RegEx that determines where to break them apart, for your sourcetype.

0 Karma

Revered Legend

Assuming when you say your can do the same at search time using rex mode=sed option, you can do the same at index-time using SEDCMD option in the props.conf. See this for more details:

0 Karma


@arpit_arora, try to take your rex to fields.conf for configuring multi-value fields using TOKENIZER:

| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...