https://community.splunk.com/t5/Splunk-Dev/Why-is-quot-must-break-after-quot-not-working/m-p/299944#M3857 <P>It looks like there's a line break - why not use SHOULD_LINEMERGE = false instead? I</P> Sun, 01 Apr 2018 21:46:54 GMT jluo_splunk 2018-04-01T21:46:54Z https://community.splunk.com/t5/Splunk-Dev/Why-is-quot-must-break-after-quot-not-working/m-p/299943#M3856 <P>I have some events and some of them are getting broken while some of them are not.<BR /> I tried everything MUST_BREAK_AFTER and LINE_BREAKER.<BR /> My event shd break after "batch_size: 15"<BR /> I have 457 events:</P> <PRE><CODE>Single event = "apple Type:apple size: report _time: 2017-03-23 01:30:00 batch_delay: 15 batch_size: 15 " </CODE></PRE> <P>but some events are merged like below and giving only one event for 257 events together.</P> <PRE><CODE>... 2 lines omitted ... apple Type:apple size: report _time: 2017-03-23 01:30:00 batch_delay: 15 batch_size: 15 apple Type:apple size: report _time: 2017-03-23 01:30:00 batch_delay: 15 batch_size: 15 apple Type:apple size: report _time: 2017-03-23 01:30:00 batch_delay: 15 batch_size: 15 </CODE></PRE> <P>props.conf I used:</P> <PRE><CODE>[sourcetype] SHOULD_LINEMERGE = true MUST_BREAK_AFTER = batch_size:\s+\d+ </CODE></PRE> <P>Please help me.</P> Tue, 29 Sep 2020 18:45:18 GMT https://community.splunk.com/t5/Splunk-Dev/Why-is-quot-must-break-after-quot-not-working/m-p/299943#M3856 akhil36109 2020-09-29T18:45:18Z https://community.splunk.com/t5/Splunk-Dev/Why-is-quot-must-break-after-quot-not-working/m-p/299944#M3857 <P>It looks like there's a line break - why not use SHOULD_LINEMERGE = false instead? I</P> Sun, 01 Apr 2018 21:46:54 GMT https://community.splunk.com/t5/Splunk-Dev/Why-is-quot-must-break-after-quot-not-working/m-p/299944#M3857 jluo_splunk 2018-04-01T21:46:54Z