Splunk Search

Can you help me with a line break issue in the following regex search?

jip31
Motivator

hello

In the file attached, i need to do a line break not after a format date like "06/09/2018 - 14:21:24" as its actually done but just after ------
so i want that _raw is equal to all the text between ----- and -----

which regex should I use please??

0 Karma
1 Solution

493669
Super Champion

can you try below-

 [yourSourceType]
 SHOULD_LINEMERGE = false
 LINE_BREAKER = (---+)
...

View solution in original post

0 Karma

pruthvikrishnap
Contributor

http://docs.splunk.com/Documentation/Splunk/7.1.3/Data/Configureeventlinebreaking#Specify_event_brea...

[source::source-to-break]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE =  -----
0 Karma

jip31
Motivator

I try tomorrow and i keep you aware 😉

0 Karma

493669
Super Champion

can you try below-

 [yourSourceType]
 SHOULD_LINEMERGE = false
 LINE_BREAKER = (---+)
...
0 Karma

jip31
Motivator

hi
it doesnt works
the line breaker is done after:
14:23:01 ./ Installation Status
../ Completed

instead
06/09/2018 - 14:23:01 -- End of installation of ePO (5.0.5.658_64b) EN
14:23:08 ./ Check Product Endpoint Security (10.5.4_64b) EN installation Status
../ Completed
.../ Not installed

0 Karma

jip31
Motivator

sorry it works ....
i need another change please
i would like to extract the word which is after "Installation of....." and the sentence "Failed Error code:"
could you help me please??

0 Karma

Anam
Community Manager
Community Manager

@jip31

This is a whole new question that is being asked in the comment and since your original question was answered I have gone ahead and accepted the answer. If @493669 can help you with your new question in this thread that is great but I would recommend refraining from posting new questions in the same thread. Please post a new question to get maximum exposure and help.

Thanks
Anam

0 Karma

493669
Super Champion

can you try :

SHOULD_LINEMERGE = true
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...