Splunk Search

Is there a way to add a line break in a search, but before piping in every other search command?

hofer
Explorer

So, after an upgrade, the logs changed, but the line-break configuration wasn't adapted immediately. Before, it was "^ericcson", now it's just a normal new-line and everything works fine.
But in the time until the configuration was changed, some data was indexed wrong. It took many lines into one event and cut it after 10,000 characters. We've got an enormous search which merges many sourcetypes into one statistic table and we need that over the period.

Is it possible to "re-break" the lines in the search before anything else (except the index)? Because with field extractions, just mvjoin or something doesn't work. It would be great to break the line with "^waphandlr" in the search.

1 Solution

masonmorales
Influencer

You're not going to like this, but sometimes it's easier to delete and re-index the data than it is to try to post-process the incorrectly indexed data.

View solution in original post

masonmorales
Influencer

You're not going to like this, but sometimes it's easier to delete and re-index the data than it is to try to post-process the incorrectly indexed data.

hofer
Explorer

OK, I see. Thanks for the answer! Since we've got a bigger splunk environement it's unfortunately not possible to delete the events (or too risky). So we gonna have to live without this data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...