Splunk Exam SPLK-1003 Topic 5 Question 51 Discussion

Line breaking, which uses theLINE_BREAKERsetting to split the incoming stream of data into separate lines. By default, theLINE_BREAKERvalue is any sequence of newlines and carriage returns. In regular expression format, this is represented as the following string:([rn]+). You don't normally need to adjust this setting, but in cases where it's necessary, you must configure it in the props.conf configuration file on the forwarder that sends the data to Splunk Cloud Platform or a Splunk Enterprise indexer. TheLINE_BREAKERsetting expects a value in regular expression format.