Getting Data In

How to line break this structured log?

afamoyib
Path Finder

I have a script generating an output, however all my output is being registered as one event. I am trying to break each line into an. I tried using the line breaker with regex for end of line. But that fails.

Example of the output.

Status                    Tag                    DisplayName
------                    ----                   -----------
Quit                      jflower                James
Terminated                wpunch                 William
Quit                      madams                 Mark
Terminated                jtota                  Jeff
Quit                      wbaker                 Baker
Quit                      sjohson                Shawn

I am trying to extract the header and

0 Karma

afamoyib
Path Finder

It was not breaking properly because of how powershell formats it output. I converted the output to csv and then ingested it into splunk. It worked like a charm

0 Karma

woodcock
Esteemed Legend
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What sourcetype did you specify for this input?
The default LINE_BREAKER setting is [\r\n] which should break events after EOL.
Please share your props.conf settings.
Your posting was cut off. What are you trying to extract with the header?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...

Global Splunk User Group Events: May + June 2026

Your Splunk Community Awaits: Discover Upcoming User Group Events Worldwide    Staying ahead in the fast-paced ...