Splunk Search

Why is the regex creating empty events from incoming data?

derekho55
Explorer

I have a log text file that captures logs in this format:

----------------------------------------
Timestamp: 5/9/2019 1:16:02 AM

Message:  Blah Blah

----------------------------------------
----------------------------------------
Timestamp: 5/9/2019 1:20:05 AM

Message: Bla Bla

----------------------------------------

I'm struggling with creating a regex expression that will not treat it as a new (empty) event.

----------------------------------------
----------------------------------------

Please help. Thanks!

0 Karma
1 Solution

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

View solution in original post

0 Karma

evania
Splunk Employee
Splunk Employee

Hi @derekho55 ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

0 Karma
Get Updates on the Splunk Community!

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...