Splunk Search

Why is the regex creating empty events from incoming data?

derekho55
Explorer

I have a log text file that captures logs in this format:

----------------------------------------
Timestamp: 5/9/2019 1:16:02 AM

Message:  Blah Blah

----------------------------------------
----------------------------------------
Timestamp: 5/9/2019 1:20:05 AM

Message: Bla Bla

----------------------------------------

I'm struggling with creating a regex expression that will not treat it as a new (empty) event.

----------------------------------------
----------------------------------------

Please help. Thanks!

0 Karma
1 Solution

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

View solution in original post

0 Karma

evania
Splunk Employee
Splunk Employee

Hi @derekho55 ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...