Is there a way to add a line break in a search, but before piping in every other search command?

[hofer]

So, after an upgrade, the logs changed, but the line-break configuration wasn't adapted immediately. Before, it was "^ericcson", now it's just a normal new-line and everything works fine.
But in the time until the configuration was changed, some data was indexed wrong. It took many lines into one event and cut it after 10,000 characters. We've got an enormous search which merges many sourcetypes into one statistic table and we need that over the period.

Is it possible to "re-break" the lines in the search before anything else (except the index)? Because with field extractions, just mvjoin or something doesn't work. It would be great to break the line with "^waphandlr" in the search.

[masonmorales · Accepted solution]

You're not going to like this, but sometimes it's easier to delete and re-index the data than it is to try to post-process the incorrectly indexed data.

[hofer]

OK, I see. Thanks for the answer! Since we've got a bigger splunk environement it's unfortunately not possible to delete the events (or too risky). So we gonna have to live without this data.