Splunk Search

Can you help me with a line break issue in the following regex search?

Contributor

hello

In the file attached, i need to do a line break not after a format date like "06/09/2018 - 14:21:24" as its actually done but just after ------
so i want that _raw is equal to all the text between ----- and -----

which regex should I use please??

0 Karma
1 Solution

Super Champion

can you try below-

 [yourSourceType]
 SHOULD_LINEMERGE = false
 LINE_BREAKER = (---+)
...

View solution in original post

0 Karma

Contributor

http://docs.splunk.com/Documentation/Splunk/7.1.3/Data/Configureeventlinebreaking#Specify_event_brea...

[source::source-to-break]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE =  -----
0 Karma

Contributor

I try tomorrow and i keep you aware 😉

0 Karma

Super Champion

can you try below-

 [yourSourceType]
 SHOULD_LINEMERGE = false
 LINE_BREAKER = (---+)
...

View solution in original post

0 Karma

Contributor

hi
it doesnt works
the line breaker is done after:
14:23:01 ./ Installation Status
../ Completed

instead
06/09/2018 - 14:23:01 -- End of installation of ePO (5.0.5.658_64b) EN
14:23:08 ./ Check Product Endpoint Security (10.5.4_64b) EN installation Status
../ Completed
.../ Not installed

0 Karma

Contributor

sorry it works ....
i need another change please
i would like to extract the word which is after "Installation of....." and the sentence "Failed Error code:"
could you help me please??

0 Karma

Moderator
Moderator

@jip31

This is a whole new question that is being asked in the comment and since your original question was answered I have gone ahead and accepted the answer. If @493669 can help you with your new question in this thread that is great but I would recommend refraining from posting new questions in the same thread. Please post a new question to get maximum exposure and help.

Thanks
Anam

0 Karma

Super Champion

can you try :

SHOULD_LINEMERGE = true
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!