Splunk Search

How to create regex for line breaking my data?

rameshlpatel
Communicator

Please help me to create regex for following type of data:

Id = 159275791

Id = 159275792

Id = 159275793

I want to break line after above type of data found by indexer

1 Solution

strive
Influencer

Try this

LINE_BREAKER=([\r\n]+)Id = \d+

This will work for variable number of digits.

if it is going to be always 9 digits then

LINE_BREAKER=([\r\n]+)Id = \d{9}

View solution in original post

strive
Influencer

Try this

LINE_BREAKER=([\r\n]+)Id = \d+

This will work for variable number of digits.

if it is going to be always 9 digits then

LINE_BREAKER=([\r\n]+)Id = \d{9}
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...