Why is Splunk not maintaining line breaks as in the original log?

[spsrasru]

splunk enterprise 6.1.1

In search view on the Splunk search head web front end, as well as in table view in the email alerts, Splunk is not maintaining line breaks as in the original log.

[edoardo_vicendo]

Ciao,

Please check my answer reported here:

https://answers.splunk.com/answers/494716/how-to-split-a-multi-line-raw-to-a-multivalue-with.html?ch...

basically you can do in this way:

your base search | rex max_match=0 "^(?<lines>.+)\n+" | eval raw2=mvindex(lines,0,-1) | table raw2

Best Regards,
Edoardo

[maimonoded]

anyone have a solution/workaround for this issue?

[adamw]

Other users are reporting the same thing since the upgrade to 6.1:
http://answers.splunk.com/answers/138053/line-breaks-being-removed-from-raw-data-in-email-alerts-aft...

[yuanliu]

@adamw the link points to this question itself. This said, I have seen this before 6, too. Does it have to do with overload? I am under the impression that this tends to happen when volume is extremely high, although I do not have direct measurement.

[adamw]

@yuanliu sorry, copy and paste fail. Updated the link to the other question.

The alert I see it on is one where the output in each _raw cell is around 20 lines. Under 6.0 it showed the _raw field in the table with the proper line breaks, but since our 6.1 upgrade, it ignores newlines in _raw and mashes all of the log data into one text blob.

It still looks properly line break'ed in the search UI.

[strive]

Can you post the original log samples and also explain where Splunk is not maintaining line breaks