I have a json blob, lets ignore the fact it is json for now. I simply want to force Splunk to break a single blob on a word.
Where the string {"agent" exists multiple times, these are the the only settings I have set in props for the sourcetype.
SHOULD_LINEMERGE = false
LINE_BREAKER = {"agent
This should break, but it is not. Why is Splunk refusing to break this event? Again, I know this is json, but I want to understand LINE_BREAKER, as I have read about 3 novels on its use, and it repeatedly fails when implemented.
The LINE_BREAKER
attribute must contain a capture group. Be warned the contents of the capture group will be discarded so choose it carefully. It's perfectly legitimate to have an empty capture group as in LINE_BREAKER = (){"agent
.
The LINE_BREAKER will not function unless you give it a capture group
(there is probably an error in your error log if you search for it with something like index=_* sourcetype=splunkd LINE_BREAKER capture
). Everything in the capture group
will be discarded. The capture group
may be empty, but it MUST exist. Try this:
SHOULD_LINEMERGE = false
LINE_BREAKER = {"agent()
Thanks, I was making it more complicated in my head.
The LINE_BREAKER
attribute must contain a capture group. Be warned the contents of the capture group will be discarded so choose it carefully. It's perfectly legitimate to have an empty capture group as in LINE_BREAKER = (){"agent
.
Missed it by >that< much.