Getting Data In

How to create a line break in an event log?

pgbr7
Explorer

Hello guys,

I need to create a line break in an event log, I have the [ \n ] in log.

I try this :

| rex mode=sed field=_raw "s/[\\n]/\n/g"

This log:

6.6.6.6 ASM: "Non-arowser Client","2014-07-15 10:21:12","4.26.140.234","443","BR","/dark-mundo-15/mundo_blue_udp_85116064569258_1","N/A","185.85.69.87","185.85.69.87%0","6.6.6.6","GET","2014-07-15 10:16:03","/dark-mundo-15/mundo_blue_udp_85116064569258_1","HTTPS","","GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatiale; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727;

Is it possible or do I need the set it in the props.conf ?

0 Karma
1 Solution

dmaislin_splunk
Splunk Employee
Splunk Employee

Maybe:

| rex mode=sed field=_raw "s/\\r\\n/\n/g"

I didn't try to load your event yet but I figured I would give it a good guess...

View solution in original post

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Maybe:

| rex mode=sed field=_raw "s/\\r\\n/\n/g"

I didn't try to load your event yet but I figured I would give it a good guess...

0 Karma

pgbr7
Explorer

Thanks, I used the following and it worked:

| rex mode=sed field=_raw "s/.r.n/ \n/g
0 Karma

pgbr7
Explorer

Thanks, but it did not work.

I tried in Splunk Web. I can change letter and number, but if i try line break, it doesn't work.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...