Newline in events

[arpit_arora]

Hello, I have Splunk events (stacktrace) which have '\n' in them. I want these '\n' to appear as new lines (but not new event).

So for example, currently my event might look like

aaaaa \n bbbbb \n ccccc \n ddddd

I want this event to appear as follows.

aaaaa
bbbbb
ccccc
ddddd

I know we can use rex command for this at search time, but I want the events to be indexed with \n character stored as newline.

How can I do this at index time?

[woodcock]

This is generally done in props.conf on your indexers by setting SHOULD_LINEMERGE = false (yes, I know that might seem wrong) and LINE_BREAKER to a very carefully constructed RegEx that determines where to break them apart, for your sourcetype.

[somesoni2]

Assuming when you say your can do the same at search time using rex mode=sed option, you can do the same at index-time using SEDCMD option in the props.conf. See this for more details:
https://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Anonymizedata

[niketn]

@arpit_arora, try to take your rex to fields.conf for configuring multi-value fields using TOKENIZER: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ConfigureSplunktoparsemulti-valuefields