I have a multi line file that I'm trying to get splunk to understand... note that I'm not using the conf files but relying on the add new data UI within splunk to help...
geo {
id: 0
internal_name: "TEST"
type: LIST
zip: 7
description: "TEST"
}
geo {
id: 1
internal_name: "TEST"
type: LIST
zip: 5
description: "TEST"
}
geo {
id: 2
internal_name: "TEST"
type: LIST
zip: 1
description: "TEST"
}
geo {
id: 3
internal_name: "TEST"
type: LIST
zip: 2
description: "TEST"
}
I've got this regex working as PCRE to break things up into events but when I use that as the line breaker regex in splunk it just spits out one massive event....
(^geo \{(?s).*?\})
What am I doing wrong?
↧