Getting Data In
Highlighted

How to edit props.conf to line break a single line event into multiple lines?

Contributor

I have a single line event as shown. I have to break it to multiple lines starting at {IBP_LKL . May I know what setting I should use in props.conf?

{IBP_LKL_MKL=avfg , gfdjgkjfsidhfkhs; {IBP_LKL_MKL=bvfg, dfuihsfslj; {IBP_LKL_MKL=fgbs, sfhdgfuygsk

break it to

{IBP_LKL_MKL=avfg , gfdjgkjfsidhfkhs;
{IBP_LKL_MKL=bvfg, dfuihsfslj; 
{IBP_LKL_MKL=fgbs, sfhdgfuygsk
0 Karma
Highlighted

Re: How to edit props.conf to line break a single line event into multiple lines?

SplunkTrust
SplunkTrust

Try this

LINE_BREAKER = (;\s)
---
If this reply helps you, an upvote would be appreciated.

View solution in original post