Getting Data In

Line Breaking without removing field

willcwhite
Explorer

In my props.conf, I have LINE_BREAKER=field1 this breaks the events how I want but it removes field1 from every event. Is there any way to keep field1 in my events but still break events after it occurs?

Thanks in advance

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks events at the first capture group in the regex and discards that regex. To avoid discarding important data, use an empty capture group.

LINE_BREAKER = field1()
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The LINE_BREAKER setting breaks events at the first capture group in the regex and discards that regex. To avoid discarding important data, use an empty capture group.

LINE_BREAKER = field1()
---
If this reply helps you, Karma would be appreciated.

Azwaliyana
Path Finder

What if my BREAK_ONLY_BEFORE=##################################################################|(pg-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(ss7-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(ss7-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(da-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(da-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-3 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(fs-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(om-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(pg-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(om-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(mms-1 \| [a-zA-Z0-9._%-]* \| rc=0 >>)|(mms-2 \| [a-zA-Z0-9._%-]* \| rc=0 >>)

How do I break it into another event but still keep the regex in the event. I dont want to remove it. This is the sample raw data. I dont want to remove the top line. But I want to break just before the top line.

pg-2 | CHANGED | rc=0 >>
Filesystem Size Used Avail Use% Mounted on
devtmpfs 16G 4.0K 16G 1% /dev
tmpfs 16G 32K 16G 1% /dev/shm
tmpfs 16G 1.6G 15G 11% /run
tmpfs 16G 0 16G 0% /sys/fs/cgroup
/dev/vda2 160G 8.4G 152G 6% /
tmpfs 3.0G 168K 3.0G 1% /tmp

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...