Getting Data In

Can you define a line break when you find a certain character?

Claudia9308
New Member

Hi,

I am trying to index data from a local directory, but the line break is not executing correctly. The expression I am using is ([\ r \ n] +), however, it is indexing me more than 3 events into just one. is there any way to define a line break when you find a certain character? for example, when find ";;;"

Labels (3)
Tags (2)
0 Karma

gcusello
Legend

Hi @Claudia9308,

to help you, you should share some example of your data.

Anyway, there are some methods  to break events that you can find at https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Propsconf#Line_breaking

Ciao.

Giuseppe

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

easiest way to test this is set up your own dev instance to your own workstation. Then use Setting -> Add Data -> Monitor -> Files & Directories and test with different parameters.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...