- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why is the event break not working when there is a new line?
Mostlyqueries
Explorer
02-21-2018
12:05 PM
Sample data:
{
"sensorName": "test1"
}
{
"sensorName": "test2"
}
{
"sensorName": "test3"
}
Tried several regex patterns and none will show as working in the Add Data screen. Same patterns work on regex websites.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
02-21-2018
02:48 PM
Try with following
SHOULD_LINEMERGE = false
LINE_BREAKER = (\r\n]+)(?\{)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yannK

Splunk Employee
02-21-2018
03:21 PM
Your data looks like json, check what is your sourcetype (and if on the forwarder it has a INDEXED_EXTRACTIONS=json in props.conf for the sourcetype)
If it's the case we should expect an automatic json event breaking.
