Getting Data In

Can you define a line break when you find a certain character?

New Member


I am trying to index data from a local directory, but the line break is not executing correctly. The expression I am using is ([\ r \ n] +), however, it is indexing me more than 3 events into just one. is there any way to define a line break when you find a certain character? for example, when find ";;;"

Labels (3)
Tags (2)
0 Karma


Hi @Claudia9308,

to help you, you should share some example of your data.

Anyway, there are some methods  to break events that you can find at



0 Karma



easiest way to test this is set up your own dev instance to your own workstation. Then use Setting -> Add Data -> Monitor -> Files & Directories and test with different parameters.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...