Splunk Search

How to create regex for line breaking my data?

rameshlpatel
Communicator

Please help me to create regex for following type of data:

Id = 159275791

Id = 159275792

Id = 159275793

I want to break line after above type of data found by indexer

1 Solution

strive
Influencer

Try this

LINE_BREAKER=([\r\n]+)Id = \d+

This will work for variable number of digits.

if it is going to be always 9 digits then

LINE_BREAKER=([\r\n]+)Id = \d{9}

View solution in original post

strive
Influencer

Try this

LINE_BREAKER=([\r\n]+)Id = \d+

This will work for variable number of digits.

if it is going to be always 9 digits then

LINE_BREAKER=([\r\n]+)Id = \d{9}
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...