Hello,
I wish to create a new sourcetype in props.conf that uses the linebreak properties such as :
SHOULD_LINEMERGE = true
BREAK_ONLY_BEFORE =
But I'm not sure what to put for the regex of BREAK_ONLY_BEFORE , does it need to be the whole line? & Does it need any capturing groups?
Also, I have a transaction command that works, but I could possibly uses that instead of props.conf, but I want to make it so that we don't have to run the transaction in all searches, any ideas?
Thanks
Break_only_before will break as soon as it finds whatever pattern you put in. If you put in a whole line, it will break a line before it finds the entire line. If you put in part of the line, as soon as it encounter that, it will break a line before that.
@sk314 - Please convert your comment to an answer so I can accept it to help the rest of the community.
Thanks
@markthompson done and done.