Splunk Search

LINE BREAKER REGEX

patriziadepaola
Explorer

Hello, i need to identify i new line in my log file when line starts with MSG or ERR in order to get the message of error in a single line.

Sample log file data:

MSG;1193342275;1784053093;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,286; - START
MSG;1193342275;1889771202;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,305; - START
ERR;1193342275;573025154;gestoreprocessi;Log.fatal;29/06/2017 05:36:14,312;org.springframework.dao.DataAccessResourceFailureException: SqlMapClient operation; SQL [];

--- The error occurred in com/cervedgroup/cicloattivo/gestoreprocessi/db/dao/ibatis/maps/ReportWorkflowProcessi.xml.

--- The error occurred while applying a result map.

--- Check the GetIdWorkflowFromIdReport-AutoResultMap.

--- Check the result mapping for the 'ID_WORKFLOW' property.

--- Cause: java.sql.SQLRecoverableException: Closed Resultset: next; nested exception is com.ibatis.common.jdbc.exception.NestedSQLException:

--- The error occurred in com/cervedgroup/cicloattivo/gestoreprocessi/db/dao/ibatis/maps/ReportWorkflowProcessi.xml.

--- The error occurred while applying a result map.

--- Check the GetIdWorkflowFromIdReport-AutoResultMap.

--- Check the result mapping for the 'ID_WORKFLOW' property.

--- Cause: java.sql.SQLRecoverableException: Closed Resultset: next
MSG;1193342275;1889771202;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,315; - elabToElab:com.cervedgroup.cicloattivo.gestoreprocessi.db.ReportElab@6da21389
MSG;1193342275;1889771202;gestoreprocessi;GestioneProcessi.elaboraProcesso;29/06/2017 05:36:14,315; - elabToElab stato:SND

Any suggestions?

Tags (1)
0 Karma
1 Solution

patriziadepaola
Explorer

I have found the solution:

BREAK_ONLY_BEFORE = MSG | ERR

it works !

View solution in original post

patriziadepaola
Explorer

I have found the solution:

BREAK_ONLY_BEFORE = MSG | ERR

it works !

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...