Getting Data In

Removing newline and carriage return

avanijjain16
Explorer

Hi, 

I am new to splunk. I am trying to make my logging message format good. 

I have log message with newline or carriage return not sure which one but when I try to replace it using 

rex field=message mode=sed "s/^[\r\n]+//g" it does not work, Any suggestions? I am not sure if there are any spaces or white spaces but I also tried with s/^/S*[\r\n]+//g

 

Message:

Line1

Line2

Line3

Expected :


Line1
Line2
Line3

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your sed matches to [\r\n] at the beginning of the field - could it be at the end? Also, are these 3 instance of the message field or multi-line with the same message instance?

Get Updates on the Splunk Community!

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...