Getting Data In

Can you use 'new line' as a delimiter?


Hi folks,

I just got a new data feed where my events come in as a multiline event, with one key/value pair on each line. The issue I have now, when a value has a space in it, it gets truncated. Is there a way to set the new line as the delimiter and include all text before the next new line? I did this before for a smaller data set, where I regex'ed all the fields manually, but this data source has a lot of different keys, and it would be tedious and hard to manage if I had to write a props regex for every single one.

Tags (2)
0 Karma

Revered Legend

What is your current props.conf for this sourcetype and can you provide some sample events?

0 Karma


In your props.conf file for this sourcetype, specify SHOULD_LINEMERGE=TRUE. That will turn your multi-line event into a single-line event. You will then have to tell Splunk where each event ends using BREAK_ONLY_BEFORE_DATE, BREAK_ONLY_BEFORE, or one of the other related settings. A sample of your data will help us help you with that.

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...