Splunk Search

Why is the regex creating empty events from incoming data?

derekho55
Explorer

I have a log text file that captures logs in this format:

----------------------------------------
Timestamp: 5/9/2019 1:16:02 AM

Message:  Blah Blah

----------------------------------------
----------------------------------------
Timestamp: 5/9/2019 1:20:05 AM

Message: Bla Bla

----------------------------------------

I'm struggling with creating a regex expression that will not treat it as a new (empty) event.

----------------------------------------
----------------------------------------

Please help. Thanks!

0 Karma
1 Solution

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

View solution in original post

0 Karma

evania
Splunk Employee
Splunk Employee

Hi @derekho55 ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...