07-01-2026 08:08 AM
Hello everyone!
I am facing a problem and hope someone can provide me with answers I have yet to find.
I am parsing syslog data into XSIAM, from a certain kind of our systems.
One of the entries in the original data for one of these systems may contain a linebreak (\n).
As this linebreak is not (properly?) escaped, this breaks the original message into two.
Fictionary example:
// original message
<42>1 2026-07-01T12:00:00.000Z host6789 - - - timestamp="1782928800" msg="auth failed" name="TestFarm\nServer6789" user="test" action="login"
// _raw_log msgs in XSIAM:
<42>1 2026-07-01T12:00:00.000Z host6789 - - - timestamp="1782928800" msg="auth failed" name="TestFarm
Server6789" user="test" action="login"
I would like to resolve this in XSIAM.
What I would want to do is artificially reconnect the two messages in the parsing rule; either by identifying that the current line is a secondary part and querying the one before and reconnecting
or, even better, by identifying the current line is the start of a broken message and querying / adding the next line to it.
Is there any way to do this? Or to handle linebreaks in any other way once the syslog hits XSIAM?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
