https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-for-a-app-log/m-p/609588#M105685 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/103126">@sathiyasun</a>,</P><P>you have a timestamp for each row, so you could also use this time stamp.</P><P>Anyway, as described at <A href="https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf</A> you could use:</P><LI-CODE lang="markup">[your_sourcetype] SHOULD_LINEMERGE = true LINE_BREAKER = \d{8}\.\d{6}:\sCron\sdummy\sstarted\sby</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 16 Aug 2022 07:29:03 GMT gcusello 2022-08-16T07:29:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-for-a-app-log/m-p/609533#M105678 <P>how to create a props.conf for the below data..Need to break the line from ### endwith&nbsp;</P> <P>&nbsp;</P> <P>########################################</P> <P>20220815.011001: =========================<BR />20220815.011001: Cron dummy started by dummy1.<BR />20220815.011001: =========================<BR />20220815.011002: 20220815.011001: Checking processes on Prod SEATTLE server seat1<BR />20220815.011001: 3 critical processes run on seat1<BR />20220815.011001: 1 non-critical processes run on seat1<BR />20220815.011001: 208 processes are now running on seat1<BR />20220815.011001: 10 processes owned by dummy1<BR />20220815.011001: SEATTLE Authentication_Process is running (581).<BR />20220815.011001: SEATTLE is running (1709).<BR />20220815.011001: PS Pmeter_Server is running (1886).<BR />20220815.011002: PS Pmeter_Server is running (2000).<BR />20220815.011002: All critical processes are running.<BR />20220815.011002: =========================<BR />20220815.011002: dummy complete.<BR />20220815.011002: =========================<BR />20220815.011501:</P> Mon, 15 Aug 2022 21:54:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-for-a-app-log/m-p/609533#M105678 sathiyasun 2022-08-15T21:54:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-for-a-app-log/m-p/609588#M105685 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/103126">@sathiyasun</a>,</P><P>you have a timestamp for each row, so you could also use this time stamp.</P><P>Anyway, as described at <A href="https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf</A> you could use:</P><LI-CODE lang="markup">[your_sourcetype] SHOULD_LINEMERGE = true LINE_BREAKER = \d{8}\.\d{6}:\sCron\sdummy\sstarted\sby</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 16 Aug 2022 07:29:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-for-a-app-log/m-p/609588#M105685 gcusello 2022-08-16T07:29:03Z