I have inputs configured to allow for multiline events, representing groups of log lines. I'm then using it to build a very simple search:
eventtype=mlc sourcetype=log4j host=x | table _time message log_level
I would like to know what happens to the data when it gets displayed in a table - it seems that the line breaks are not preserved, but are converted into `/s`. Is this correct? Is there any way I can preserve the line breaks? Or even just see the literal `/n` character, or whatever it is.
Thanks,
John Raftery
↧