Splunk Search

How to parse an Aide scan log file to display each line?

bcain22
Engager

I am new to Splunk and I am trying to parse an Aide scan log file to display each line. Currently, Splunk just reads all the lines as a single event.  I know I may have to build a regex once I have Splunk reading the file correctly, but currently Splunk isn't extracting the events by the newline character. Sample data below:

bcain22_2-1647895680328.png

 

bcain22_1-1647895288925.png

 

How can I get Splunk to parse each line vs reading the entire file as a single event?

bcain22_0-1647895236764.png

 

 

0 Karma
1 Solution

bcain22
Engager
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...