Getting Data In

multiple breaks

akarandjeff
New Member

Is there a way to break by timestamp and by a pattern? Some of my lines have a timestamp and the timestamp filtering works for them, but globs my non-timestamp lines together. Other lines have a common pattern and using BREAK_ONLY_BEFORE works for them, but globs the timestamp lines together. I need to have my cake and eat it too and would like to be able to filter by both.

Tags (1)
0 Karma

hexx
Splunk Employee
Splunk Employee

If your goal is for each line to be indexed as one event, you can simply specify:

SHOULD_LINEMERGE = false

If you want to event-break on time stamps and on another pattern, a simple way to do this is to define BREAK_ONLY_BEFORE with two patterns:

BREAK_ONLY_BEFORE = (pattern1|pattern2)

...where pattern1 matches your time stamps and pattern2 matches the other desired event-breaking string.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...