I have a large (10's of thousands of lines) data stream that runs every 10 minutes and I want it to break after this line:
sharing = default_shared
I tried putting in:
MUST_BREAK_AFTER = (sharing = default_shared)
But this did not work.
I was hoping it would take the literal string, but it's not working.
Try something like this
[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER= ([\r\n]+)(?=sharing\s*=\s*default_shared)
... other configs....
Try something like this
[yoursourcetype]
SHOULD_LINEMERGE=false
LINE_BREAKER= ([\r\n]+)(?=sharing\s*=\s*default_shared)
... other configs....
Worked like a champ!! Thanks so much!