What is the default value of LINE_BREAKER?

The correct answer is B. ([\r\n]+). Line breaking, which uses the LINE_BREAKER setting to split the incoming stream of data into separate lines. By default, the LINE_BREAKER value is any sequence of newlines and carriage returns. In regular expression format, this is represented as the following string: ([\r\n]+).

Splunk Indexing

Question

Options

A\r\n
B([\r\n]+)
C\r+\n+
D(\r\n+)

How the community answered

(25 responses)

B
92% (23)
C
4% (1)
D
4% (1)

Explanation

Line breaking, which uses the LINE_BREAKER setting to split the incoming stream of data into separate lines. By default, the LINE_BREAKER value is any sequence of newlines and carriage returns. In regular expression format, this is represented as the following string: ([\r\n]+). You don't normally need to adjust this setting, but in cases where it's necessary, you must configure it in the props.conf configuration file on the forwarder that sends the data to Splunk Cloud Platform or a Splunk Enterprise indexer. The LINE_BREAKER setting expects a value in regular expression format.

Topics

#LINE_BREAKER#Event Parsing#props.conf#Regular Expressions

Community Discussion

No community discussion yet for this question.

Full SPLK-1003 Practice