Getting Data In

Why is Splunk not showing empty lines when ingesting files?

MedralaG
Communicator

This is such a basic question I'm almost embarrassed to ask.

When I try to ingest a file into splunk that has some rows of text with empty lines in between some lines (same as in any .conf file) splunk skips the empty rows. I want to be able to see them as I wan to use those blank lines as event breakers.
Why does that happen?

ex:

[test]
test =1
test2 = x

[test3]
blah 
blah
0 Karma

somesoni2
Revered Legend

Are you breaking events in a way that each line is a separate event in Splunk? Splunk would not index blank lines, probably the reson you don't see it. If you want a whole stanza a one event, you'd need to setup your event breaking to do so.

0 Karma

MedralaG
Communicator

Yes, I know that the capture group of the event breaker gets removed but this happens before I even specify the event breaker.
So if I take a file and try to upload it to Splunk via the web interface, the preview part that lets you define the line breaker and all other index-time props settings already show the content of the file with no empty lines.

0 Karma

FrankVl
Ultra Champion

Isn't that simply because the default line breaker is ([\r\n]+). An empty line is simply a series of \r and or \n characters, so those will all get gobled up by the linebreaking.

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...