This is such a basic question I'm almost embarrassed to ask.
When I try to ingest a file into splunk that has some rows of text with empty lines in between some lines (same as in any .conf file) splunk skips the empty rows. I want to be able to see them as I wan to use those blank lines as event breakers.
Why does that happen?
ex:
[test]
test =1
test2 = x
[test3]
blah
blah
Are you breaking events in a way that each line is a separate event in Splunk? Splunk would not index blank lines, probably the reson you don't see it. If you want a whole stanza a one event, you'd need to setup your event breaking to do so.
Yes, I know that the capture group of the event breaker gets removed but this happens before I even specify the event breaker.
So if I take a file and try to upload it to Splunk via the web interface, the preview part that lets you define the line breaker and all other index-time props settings already show the content of the file with no empty lines.
Isn't that simply because the default line breaker is ([\r\n]+)
. An empty line is simply a series of \r
and or \n
characters, so those will all get gobled up by the linebreaking.
hello there,
check out this answer:
https://answers.splunk.com/answers/24588/how-can-i-check-that-splunk-indexed-the-entire-contents-of-...
hope it helps