Getting Data In

LINE_BREAKER- how to add


How to add the LINE_BREAKER in propd .conf for the below events to get it split to different events . Currently these are comign as combines together 


Path =567 xcss sdsf  

Path = 5673 dvgsdbdv  v

Path = 43343 dvddv 


I tried

LINE_BREAKER = ([\r\n]+)\Path      


But didnt worked 

Labels (1)
0 Karma



with that data there shouldn’t be any needs for anything else than default line breaker. It seems to be an event per line.

Also \P should be just P as those two has totally different meanings.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...