Break Events
This topic describes how to use the function in the .
Description
The Break Events function breaks grouped events into multiple events using a valid regular expression as the delimiter.
Function Input/Output Schema
- Function Input
- collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
- collection<record<R>>
- This function outputs collections of records with schema R.
Syntax
The required fields are in bold font.
- break_events
- content=<field>
- delimiter=<regular-expression>
- [output=<newfield>]
Required arguments
- content
- Syntax: <field>
- Description: The field whose values will be broken into single events.
- delimiter
- Syntax: <regular-expression>
- Description: A Java regular expression delimiter used to break events.
Optional arguments
- output
- Syntax: <string>
- Description: The name of the output field in the new event.
- Default: body
Example
Examples of common use cases follow. These examples assume that you have added the function to your pipeline.
1. SPL2 Example: Break events using a new line as a delimiter.
This example assumes that you are in the SPL View.
...| break_events content=host delimiter= /\n/ output=new_field|...;
2. SPL2 Example: Break body into multiple events using a new line as a delimiter.
This example assumes that you are in the SPL View.
... | break_events output=new_field content=cast(body, "string") delimiter=/\n/ |...;
3. SPL2 Example: Break body into multiple events using a comma as a delimiter.
This example assumes that you are in the SPL View.
... | break_events content=cast(body, "string") delimiter=/,/ |...;
Bin | Datagen (beta) |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0, 1.2.1-patch02, 1.2.1, 1.2.2-patch02, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5
Feedback submitted, thanks!