Getting Data In

Any way to fix incorrect line break without reindex?

kenliu
Explorer

A line breaking RegEx change was mistakenly made to one of our sourcetype. We caught the error a few hours later but now we ended up with multiple events indexed as one. We have since fixed the RegEx but this impacted several hundred log files with several million events and some original logs on the server have been rolled and purged so delete and reindex isn't an option. Is there any way to reprocess event line breaking in place?

Tags (2)

asimagu
Builder
0 Karma

sowings
Splunk Employee
Splunk Employee

I don't know of a way, sorry. We talk about six "immutable" quantities related to indexed events: index, source, sourcetype, event time, line breaks, and host(name). I have a feeling that once it's indexed that way, you're stuck.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...