Getting Data In

LINE_BREAKER keep the line breaking regex string

season88481
Contributor

Hi team,

I have logs like this:

This is Tom This is Amy This is David This is Ben

I want the line breaking to be like this:

This is Tom
This is Amy
This is David
This is Ben

Here is my LINE_BREAKER config

LINE_BREAKER = (this)

And my result is like:

 is Tom
 is Amy
 is David
 is Ben

So how could I keep the line breaking regex? In my case, the "this"?

Many thanks.
S

0 Karma
1 Solution

season88481
Contributor

I think I can answer my own question. Seems Line breaker needs 1 capturing group. Anything matched in the group will not be indexed.
So I updated the LINE_BREAKER to be:
LINE_BREAKER = (\s)this\s

View solution in original post

0 Karma

season88481
Contributor

I think I can answer my own question. Seems Line breaker needs 1 capturing group. Anything matched in the group will not be indexed.
So I updated the LINE_BREAKER to be:
LINE_BREAKER = (\s)this\s

0 Karma

to4kawa
Ultra Champion

LINE_BREAKER is REGEX
this is not same This

LINE_BREAKER = (?i)(\s)This

Line breaker needs 1 capturing group.
Yes, you are.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...