Regex for custom SPL Services sourcetypes not working as intended

[Martin Hettervik]

Hi,

I noticed that one of my Linux inputs from this TA didn't line break as intended, namely ssh:known_hosts. I took a look in props.conf, and noticed that the line breaker was sat as the following "^((?!))$". This also applies to other sourcetypes, namely ssh:authorized_keys and ssh:pub_key.

Is this line breaker correct? As far as I can tell this is an empty negative lookahead regex, and will never match anything. Wouldn't it have been better to use the default line breaker "([\r\n]+)"?