Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Can you help me fix my regex to event break a multiline file?

$
0
0
I have a multiline file that I'm trying to get Splunk to understand... note that I'm not using the .conf files, but relying on the add new data UI within Splunk to help... geo { id: 0 internal_name: "TEST" type: LIST zip: 7 description: "TEST" } geo { id: 1 internal_name: "TEST" type: LIST zip: 5 description: "TEST" } geo { id: 2 internal_name: "TEST" type: LIST zip: 1 description: "TEST" } geo { id: 3 internal_name: "TEST" type: LIST zip: 2 description: "TEST" } I've got this regex working as PCRE to break things up into events, but when I use that as the line breaker regex in Splunk, it just spits out one massive event.... (^geo \{(?s).*?\}) What am I doing wrong?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>