Getting Data In

Configure multiple LINE_BREAKER strings?

woodcock
Esteemed Legend

I have line breaks signified by 2 different strings.

This works (keeping BK1 text as part of next event):

LINE_BREAKER = ([\r\n]+)(BK1)

This works (discarding BK2 text as part of breaker):

LINE_BREAKER = ([\r\n]+BK2)

But this does not work:

LINE_BREAKER = (?:([\r\n]+)(BK1))|(?:([\r\n]+BK2))

I assume this doesn't work because the 3 captures are taken as $1, $2 and $3 (and $3 is undefined as far as LINE_BREAKER REGEX goes) instead of as $1, $2v1, $2v2.

Tags (2)
0 Karma

Ayn
Legend

I find that dealing with LINE_BREAKER settings tends to get messy when often it's simpler and equally effective to achieve the same thing by configuring proper line merging settings instead. Have you investigated that option?

0 Karma

woodcock
Esteemed Legend

Using LINE_BREAKER if it is a valid option, is always the most efficient impact on the Indexer, so I always start there.

0 Karma

fairoldi
New Member

You can try:

LINE_BRAKER=([\r\n]+(?=BK1)|[\r\n]+BK2)

However this is subject to lookahead limitations: if I remember correctly this means you can not use +,? and * in BK1 (not sure about {n})

0 Karma

_d_
Splunk Employee
Splunk Employee

Give this a try:

LINE_BREAKER = ([\r\n]+BK2)|([\r\n]+)(?=BK1)

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

woodcock
Esteemed Legend

No worky; this completely ate the records starting with BK1 (for the same $1/$2/$3 reason/problem).

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...