Correct REGEX for separating TIMESTAMP - val1;val2;val1;val2;.....

[zachary_hickman]

Hello,

I have data that appears in this format:

TIMESTAMP VAL1;VAL2; VAL1;VAL2

I want Splunk to interpret the data as such:

TIMESTAMP VAL1;VAL2;,

TIMESTAMP VAL1;VAL2;,

basically so that each combo of val1 and val2 is considered one event, and the timestamp applies to each of those events. I assume I need to use a certain regex pattern to separate events, but I do not know how to do this, especially with that timestamp at the beginning.

[Rob · Accepted solution]

I think what you are looking for is to use the line breaker to break up the events.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Data/Indexmulti-lineevents

The problem is that when you break up the line, it may not maintain the time stamp as Splunk will look for another timestamp after the break. So this might be less than ideal depending on what you are looking to do with your data. It might be better to reformat the source data to have a timestamp with each key value pair. Otherwise, you may want to take a look at the search language to provide you with different ways to format your data from values in a single event.

[zachary_hickman]

The regex that works on a regex tester is [A-Za-z0-9]+;\d+;, but this does not work when trying to event break.