I am having some issues breaking a multiline event properly. Each event starts with a 'Date ...' string that I can use as an event break so I used the web app to create a sourcetype that uses the regex Date.* to separate out the event. I loaded some dummy data events and they were all broken into 1 line each instead of the entire event of 10+ lines.
I've played with the splunk cli test sourcetype but could not figure out how to specify the app context. Is there a way to test out the app's .conf file besides loading and reloading my test data in? I'm doing all of this on a single server instance.
↧