Getting Data In

Why is Splunk not showing empty lines when ingesting files?

MedralaG
Communicator

This is such a basic question I'm almost embarrassed to ask.

When I try to ingest a file into splunk that has some rows of text with empty lines in between some lines (same as in any .conf file) splunk skips the empty rows. I want to be able to see them as I wan to use those blank lines as event breakers.
Why does that happen?

ex:

[test]
test =1
test2 = x

[test3]
blah 
blah
0 Karma

somesoni2
Revered Legend

Are you breaking events in a way that each line is a separate event in Splunk? Splunk would not index blank lines, probably the reson you don't see it. If you want a whole stanza a one event, you'd need to setup your event breaking to do so.

0 Karma

MedralaG
Communicator

Yes, I know that the capture group of the event breaker gets removed but this happens before I even specify the event breaker.
So if I take a file and try to upload it to Splunk via the web interface, the preview part that lets you define the line breaker and all other index-time props settings already show the content of the file with no empty lines.

0 Karma

FrankVl
Ultra Champion

Isn't that simply because the default line breaker is ([\r\n]+). An empty line is simply a series of \r and or \n characters, so those will all get gobled up by the linebreaking.

adonio
SplunkTrust
SplunkTrust
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!