https://community.splunk.com/t5/Splunk-Enterprise/Need-line-breaker-for-below-two-types-of-events/m-p/603309#M13008 <P>The default <FONT face="courier new,courier">LINE_BREAKER = ([\r\n]+)</FONT> should work for those events (at least the part that is shared).</P><P>The trouble you'll have is with the TIME_FORMAT setting.&nbsp; No format will match both of those events so you're better off leaving out TIME_FORMAT and letting Splunk figure out each format on its own.&nbsp; It'll be a little slower, but should work.</P><P>If those events are in different files then then you should use different sourcetypes and the above won't apply.</P> Mon, 27 Jun 2022 00:35:01 GMT richgalloway 2022-06-27T00:35:01Z https://community.splunk.com/t5/Splunk-Enterprise/Need-line-breaker-for-below-two-types-of-events/m-p/603301#M13006 <P><SPAN>i have two types of events which starts with below two formats:<BR />2022-01-18 15:20:42,727, xyz........................</SPAN><BR /><SPAN>[Sun Mar 16 15:21:18.350517 2022], xyz.................<BR />what all need to write in props.conf to see both types of events.</SPAN></P> Sun, 26 Jun 2022 19:49:50 GMT https://community.splunk.com/t5/Splunk-Enterprise/Need-line-breaker-for-below-two-types-of-events/m-p/603301#M13006 Santosh2 2022-06-26T19:49:50Z https://community.splunk.com/t5/Splunk-Enterprise/Need-line-breaker-for-below-two-types-of-events/m-p/603309#M13008 <P>The default <FONT face="courier new,courier">LINE_BREAKER = ([\r\n]+)</FONT> should work for those events (at least the part that is shared).</P><P>The trouble you'll have is with the TIME_FORMAT setting.&nbsp; No format will match both of those events so you're better off leaving out TIME_FORMAT and letting Splunk figure out each format on its own.&nbsp; It'll be a little slower, but should work.</P><P>If those events are in different files then then you should use different sourcetypes and the above won't apply.</P> Mon, 27 Jun 2022 00:35:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/Need-line-breaker-for-below-two-types-of-events/m-p/603309#M13008 richgalloway 2022-06-27T00:35:01Z