Why is Splunk not showing empty lines when ingesting files?

[MedralaG]

This is such a basic question I'm almost embarrassed to ask.

When I try to ingest a file into splunk that has some rows of text with empty lines in between some lines (same as in any .conf file) splunk skips the empty rows. I want to be able to see them as I wan to use those blank lines as event breakers.
Why does that happen?

ex:

[test]
test =1
test2 = x

[test3]
blah 
blah

[somesoni2]

Are you breaking events in a way that each line is a separate event in Splunk? Splunk would not index blank lines, probably the reson you don't see it. If you want a whole stanza a one event, you'd need to setup your event breaking to do so.

[MedralaG]

Yes, I know that the capture group of the event breaker gets removed but this happens before I even specify the event breaker.
So if I take a file and try to upload it to Splunk via the web interface, the preview part that lets you define the line breaker and all other index-time props settings already show the content of the file with no empty lines.

[FrankVl]

Isn't that simply because the default line breaker is ([\r\n]+). An empty line is simply a series of \r and or \n characters, so those will all get gobled up by the linebreaking.

[adonio]

hello there,

check out this answer:
https://answers.splunk.com/answers/24588/how-can-i-check-that-splunk-indexed-the-entire-contents-of-...

hope it helps