Getting Data In

Configure BREAK_ONLY_BEFORE

Azwaliyana
Path Finder

I just want to configure BREAK_ONLY_BEFORE. When I save the source type, it automatically adds LINE_BREAKER. I do not want the LINE_BREAKER to be there as it will remove the regex that I have specified in BREAK_ONLY_BEFORE. I have done many things. 

I want it to be like this.

Azwaliyana_0-1635827337188.png

 

But when I save it, Splunk automatically add the regex that I have specified for BREAK_ONLY_BEFORE as LINE_BREAKER. And the result is like this. Splunk remove the pg-2

Azwaliyana_1-1635827483476.png

 

What should I do to keep my regex not being removed by Splunk but I want it to split into another event?

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are you saving the settings?  I've never seen Splunk automatically add LINE_BREAKER before.  What version of Splunk are you using?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Azwaliyana
Path Finder

I click on Save As button that appears here which is for the source type after uploading the file. 

Azwaliyana_0-1636517376531.png

 

Do you have any solutions for this? I use Splunk 8.1.3

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...