Getting Data In

Line Breaking without removing field

willcwhite
Explorer

In my props.conf, I have LINE_BREAKER=field1 this breaks the events how I want but it removes field1 from every event. Is there any way to keep field1 in my events but still break events after it occurs?

Thanks in advance

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks events at the first capture group in the regex and discards that regex. To avoid discarding important data, use an empty capture group.

LINE_BREAKER = field1()
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks events at the first capture group in the regex and discards that regex. To avoid discarding important data, use an empty capture group.

LINE_BREAKER = field1()
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!