Splunk Search

Must break event after x characters

himynamesdave
Contributor

I have events that are all 144 chars.

Is there a setting in props.conf (not regex) that I can use to specify 144 chars to break after? I can't find anything in the docs.

If not, does anyone have a solid regex to do this?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

In props.conf? Check.
Not regex? Uhhhmmm...

Try this:

[144_char_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = .{144}()

The empty capturing group () is important.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

In props.conf? Check.
Not regex? Uhhhmmm...

Try this:

[144_char_sourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = .{144}()

The empty capturing group () is important.

himynamesdave
Contributor

was hoping for a char_length= but that works just as well 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...