Need help on rex

[vishwa]

Below are the sample logs , i am not getting how to write props line breaker. can anyone help on this.

A0C0A0H8~~AB~ABCg.C~AB~Wed Jan 11 19:11:17 IST 2021~C~0.00~0.00~0.01~Z~1HTYYY

B0C0A0K8~~AB~ABCUHg.C~AB~Mon Jan 10 20:11:17 IST 2021~C~0.00~0.00~0.01~Z~1HTYYY1245

D0C01010~~CD~SDRg.D~HH~Thu Jan 20 11:11:17 IST 2021~C~0.00~0.00~0.01~Z~1140AU

A0C01212~~AB~ABCg.C~AB~Wed Jan 11 19:11:17 IST 2021~C~0.00~0.00~0.01~Z~1HTYYY

[richgalloway]

If it's a single line per event then the standard line breaker ([\r\n]+) should work fine.

What settings are you using now and how are they failing you?

This Splunk Lantern article may shed some light on the process: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Data_Management/Configuring_new_source_types