Getting Data In

How to edit props.conf to line break a single line event into multiple lines?

ankithreddy777
Contributor

I have a single line event as shown. I have to break it to multiple lines starting at {IBP_LKL . May I know what setting I should use in props.conf?

{IBP_LKL_MKL=avfg , gfdjgkjfsidhfkhs; {IBP_LKL_MKL=bvfg, dfuihsfslj; {IBP_LKL_MKL=fgbs, sfhdgfuygsk

break it to

{IBP_LKL_MKL=avfg , gfdjgkjfsidhfkhs;
{IBP_LKL_MKL=bvfg, dfuihsfslj; 
{IBP_LKL_MKL=fgbs, sfhdgfuygsk
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

LINE_BREAKER = (;\s)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this

LINE_BREAKER = (;\s)
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...