Splunk Search

Why is the regex creating empty events from incoming data?

derekho55
Explorer

I have a log text file that captures logs in this format:

----------------------------------------
Timestamp: 5/9/2019 1:16:02 AM

Message:  Blah Blah

----------------------------------------
----------------------------------------
Timestamp: 5/9/2019 1:20:05 AM

Message: Bla Bla

----------------------------------------

I'm struggling with creating a regex expression that will not treat it as a new (empty) event.

----------------------------------------
----------------------------------------

Please help. Thanks!

0 Karma
1 Solution

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

View solution in original post

0 Karma

evania
Splunk Employee
Splunk Employee

Hi @derekho55 ,

Did you have a chance to check out any answers? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.

Thanks for posting!

0 Karma

aromanauskas
Path Finder

This method will break the event and remove the top and bottom dashed lines from the event.

LINE_BREAKER = (\s+-+[\n\r\s]+-+)|(\s+-+[\n\r\s]+)

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...