LINE_BREAKER not working with most basic settings

[Cuyose]

I have a json blob, lets ignore the fact it is json for now. I simply want to force Splunk to break a single blob on a word.

Where the string {"agent" exists multiple times, these are the the only settings I have set in props for the sourcetype.

SHOULD_LINEMERGE = false
LINE_BREAKER = {"agent

This should break, but it is not. Why is Splunk refusing to break this event? Again, I know this is json, but I want to understand LINE_BREAKER, as I have read about 3 novels on its use, and it repeatedly fails when implemented.

[woodcock]

The LINE_BREAKER will not function unless you give it a capture group (there is probably an error in your error log if you search for it with something like index=_* sourcetype=splunkd LINE_BREAKER capture). Everything in the capture group will be discarded. The capture group may be empty, but it MUST exist. Try this:

SHOULD_LINEMERGE = false
LINE_BREAKER = {"agent()

[Cuyose]

Thanks, I was making it more complicated in my head.

[richgalloway · Accepted solution]

The LINE_BREAKER attribute must contain a capture group. Be warned the contents of the capture group will be discarded so choose it carefully. It's perfectly legitimate to have an empty capture group as in LINE_BREAKER = (){"agent.

[woodcock]

Missed it by >that< much.