Splunk Search

How to create regex for line breaking my data?

rameshlpatel
Communicator

Please help me to create regex for following type of data:

Id = 159275791

Id = 159275792

Id = 159275793

I want to break line after above type of data found by indexer

1 Solution

strive
Influencer

Try this

LINE_BREAKER=([\r\n]+)Id = \d+

This will work for variable number of digits.

if it is going to be always 9 digits then

LINE_BREAKER=([\r\n]+)Id = \d{9}

View solution in original post

strive
Influencer

Try this

LINE_BREAKER=([\r\n]+)Id = \d+

This will work for variable number of digits.

if it is going to be always 9 digits then

LINE_BREAKER=([\r\n]+)Id = \d{9}
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...