Getting Data In

line breaking - regex and capturing group


Hello, Need some help on regex here, am sure i maybe making mistake here but..

trying to break these into seperate events by using LINE_BREAKER under props.conf

sample output of my event :


my props.conf LINE_BREAKER looks like this :

LINE_BREAKER = (tcp/http")

what's happening here is since this is capturing group, it doesnt get displayed in the actual event, looks like this : (without the tcp/http)


i tried using look-ahead like these but its still not working :

LINE_BREAKER = =(?=(tcp/http"))

LINE_BREAKER = =((?=tcp/http"))

any help on this ?

thanks pmr

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

You probably want something more like:

LINE_BREAKER = ([\r\n]+)(?=\"datetime\=)