Getting Data In

Can you use 'new line' as a delimiter?

jravida
Communicator

Hi folks,

I just got a new data feed where my events come in as a multiline event, with one key/value pair on each line. The issue I have now, when a value has a space in it, it gets truncated. Is there a way to set the new line as the delimiter and include all text before the next new line? I did this before for a smaller data set, where I regex'ed all the fields manually, but this data source has a lot of different keys, and it would be tedious and hard to manage if I had to write a props regex for every single one.

Tags (2)
0 Karma

somesoni2
Revered Legend

What is your current props.conf for this sourcetype and can you provide some sample events?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In your props.conf file for this sourcetype, specify SHOULD_LINEMERGE=TRUE. That will turn your multi-line event into a single-line event. You will then have to tell Splunk where each event ends using BREAK_ONLY_BEFORE_DATE, BREAK_ONLY_BEFORE, or one of the other related settings. A sample of your data will help us help you with that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...