I am new to Splunk and I am trying to parse an Aide scan log file to display each line. Currently, Splunk just reads all the lines as a single event. I know I may have to build a regex once I have Splunk reading the file correctly, but currently Splunk isn't extracting the events by the newline character. Sample data below:
How can I get Splunk to parse each line vs reading the entire file as a single event?
Found a similar article with a great solution:
https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-data-from-this-aide-output/m-p/206792
Found a similar article with a great solution:
https://community.splunk.com/t5/Splunk-Search/How-do-I-extract-data-from-this-aide-output/m-p/206792