Getting Data In

What is the best way to display a payload with line breaks for better readability in Splunk Web?

ram_85
Explorer

I want to display the payload with line breaks for better readability on Splunk Web.

Splunk receives the payload as a stream of data with no line breaks which results in a continuous text. So we included a unique string at the end of the line before sending to Splunk. We are trying to replace the unique string 
     with line breaks so that it will helps the with the readability. Will LINE_BREAKER work for this?

Current:


    Exception in thread "main" java.lang.NullPointerException
    at com.example.myproject.Book.getTitle(Book.java:16)
    at com.example.myproject.Author.getBookTitles(Author.java:25)
    at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
    
    

Expected:

Exception in thread "main" java.lang.NullPointerException
at com.example.myproject.Book.getTitle(Book.java:16)
at com.example.myproject.Author.getBookTitles(Author.java:25)
at com.example.myproject.Bootstrap.main(Bootstrap.java:14)
0 Karma
1 Solution

ram_85
Explorer

This works for me.

| rex mode=sed "s/ /\n/g"

View solution in original post

0 Karma

ram_85
Explorer

This works for me.

| rex mode=sed "s/ /\n/g"

0 Karma

ram_85
Explorer

Rex mode command works and I am assuming SEDCMD will also work. I am worried about the performance. Will there be any impacts on the performance if SEDCMD command is used?

rex mode=sed "s/ /\n/g"
SEDCMD-breaklinekpaths=s/ /\n/g

0 Karma

bmacias84
Champion

Should be too bad, but this seem to be your only option.

0 Karma

bmacias84
Champion

LINE_BREAKER is intended to create new events which I doubt you want each line to be a separate Splunk event. Why is your log inserting characters as HTML entities? I think the best way would be to use sed to convert all the html entities or build a Splunk command.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...