Getting Data In

LINE_BREAKER keep the line breaking regex string

season88481
Contributor

Hi team,

I have logs like this:

This is Tom This is Amy This is David This is Ben

I want the line breaking to be like this:

This is Tom
This is Amy
This is David
This is Ben

Here is my LINE_BREAKER config

LINE_BREAKER = (this)

And my result is like:

 is Tom
 is Amy
 is David
 is Ben

So how could I keep the line breaking regex? In my case, the "this"?

Many thanks.
S

0 Karma
1 Solution

season88481
Contributor

I think I can answer my own question. Seems Line breaker needs 1 capturing group. Anything matched in the group will not be indexed.
So I updated the LINE_BREAKER to be:
LINE_BREAKER = (\s)this\s

View solution in original post

0 Karma

season88481
Contributor

I think I can answer my own question. Seems Line breaker needs 1 capturing group. Anything matched in the group will not be indexed.
So I updated the LINE_BREAKER to be:
LINE_BREAKER = (\s)this\s

0 Karma

to4kawa
Ultra Champion

LINE_BREAKER is REGEX
this is not same This

LINE_BREAKER = (?i)(\s)This

Line breaker needs 1 capturing group.
Yes, you are.

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...