Hello guys,
I need to create a line break in an event log, I have the [ \n ] in log.
I try this :
| rex mode=sed field=_raw "s/[\\n]/\n/g"
This log:
6.6.6.6 ASM: "Non-arowser Client","2014-07-15 10:21:12","4.26.140.234","443","BR","/dark-mundo-15/mundo_blue_udp_85116064569258_1","N/A","185.85.69.87","185.85.69.87%0","6.6.6.6","GET","2014-07-15 10:16:03","/dark-mundo-15/mundo_blue_udp_85116064569258_1","HTTPS","","GET / HTTP/1.1\r\nAccept: */*\r\nUser-Agent: Mozilla/4.0 (compatiale; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727;
Is it possible or do I need the set it in the props.conf ?
Maybe:
| rex mode=sed field=_raw "s/\\r\\n/\n/g"
I didn't try to load your event yet but I figured I would give it a good guess...
Maybe:
| rex mode=sed field=_raw "s/\\r\\n/\n/g"
I didn't try to load your event yet but I figured I would give it a good guess...
Thanks, I used the following and it worked:
| rex mode=sed field=_raw "s/.r.n/ \n/g
Thanks, but it did not work.
I tried in Splunk Web. I can change letter and number, but if i try line break, it doesn't work.