Getting Data In

multiple breaks

New Member

Is there a way to break by timestamp and by a pattern? Some of my lines have a timestamp and the timestamp filtering works for them, but globs my non-timestamp lines together. Other lines have a common pattern and using BREAK_ONLY_BEFORE works for them, but globs the timestamp lines together. I need to have my cake and eat it too and would like to be able to filter by both.

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

If your goal is for each line to be indexed as one event, you can simply specify:

SHOULD_LINEMERGE = false

If you want to event-break on time stamps and on another pattern, a simple way to do this is to define BREAK_ONLY_BEFORE with two patterns:

BREAK_ONLY_BEFORE = (pattern1|pattern2)

...where pattern1 matches your time stamps and pattern2 matches the other desired event-breaking string.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!