https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing/m-p/60546#M12025 <P>I would suggest using a different approach;</P> <PRE><CODE>SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d+\.\d+\[\d+\]\s+\+\+\+\S\s </CODE></PRE> <P>Which should cut on the newline before a row with '+++' in it</P> <P>Hope this helps,</P> <P>K</P> Wed, 12 Jun 2013 09:27:20 GMT kristian_kolb 2013-06-12T09:27:20Z https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing/m-p/60545#M12024 <P>Need help in parsing the below data :</P> <PRE><CODE>000008360.46880570[4940] +++&lt; 15:32:12.832 0h [RC2:0h Owner:0] Pid/Tid:4940/5196 000008370.46880570[4940] Source: Routine CReprintServer::initialize(), SubRoutine:&lt;none&gt;, Line:150 000008380.46880570[4940] 000008390.47006419[4940] +++T 15:32:12.832 102h [RC2:0h Owner:0] Pid/Tid:4940/5196 000008400.47006419[4940] Source: Routine MANH_Print_Service::PRINT_TEST::GetLabelSubsForCarton, SubRoutine:&lt;none&gt;, Line:0 000008410.47006419[4940] Substitution Value [0]: In Catch Block prior call to get substitution m_xmlSession :&lt;session id="NOCORBA"&gt;&lt;user&gt;TKMAX93UI&lt;/user&gt;&lt;role&gt;&lt;/role&gt;&lt;warehouse id="1"&gt;873&lt;/warehouse&gt;&lt;company id="1"&gt;01&lt;/company&gt;&lt;division id="1"&gt;01&lt;/division&gt;&lt;requestor&gt;806_IS01&lt;/requestor&gt;&lt;menuid&gt;2190&lt;/menuid&gt;&lt;customerid&gt;&lt;/customerid&gt;&lt;corbalogin&gt;IOR:012020201300000049444c3a506b4c6f67696e5f49463a312e300020010000000000000068000000010102200c00000031302e322e34312e31303500c6eb20201c00000000564201000000022f002020000000033362642051b64c57000cf81c020000000353495605000000010407010320202001000000140000000120202001000100000000000901010000000000&lt;/corbalogin&gt;&lt;language&gt;ENG&lt;/language&gt;&lt;browsertype&gt;&lt;/browsertype&gt;&lt;debuglevel&gt;&lt;/debuglevel&gt;&lt;ipaddress&gt;&lt;/ipaddress&gt;&lt;requestid&gt;&lt;/requestid&gt;&lt;pagesize&gt;200&lt;/pagesize&gt;&lt;dbtype&gt;&lt;/dbtype&gt;&lt;datemask&gt;MM/DD/YY&lt;/datemask&gt;&lt;timemask&gt;HH:MM&lt;/timemask&gt;&lt;whse_tz&gt;US/Eastern&lt;/whse_tz&gt;&lt;user_tz&gt;Warehouse&lt;/user_tz&gt;&lt;errors/&gt;&lt;three_pl enterprise="N" loginsvr3pl="N"&gt;&lt;default_co_div id="1" co="01" div="01" skumask=" | | |AAAAAAAA| | | | | "/&gt;&lt;eligible_co_div&gt;&lt;eligible id="1" co="01" div="01" skumask=" | | |AAAAAAAA| | | | | "/&gt;&lt;/eligible_co_div&gt;&lt;/three_pl&gt;&lt;print_source&gt;PkMSLaunch&lt;/print_source&gt;&lt;info&gt;&lt;system&gt;&lt;logrecords&gt;&lt;logrecord index="0"&gt;&lt;id&gt;{FE77421B-D2D5-11E2-9470-00505687047E}&lt;/id&gt;&lt;whenoccurred&gt;2013/06/11 15:32:12.472&lt;/whenoccurred&gt;&lt;routinename&gt;PkMSError::Error()&lt;/routinename&gt;&lt;subroutinename&gt;CReprintServer::getShippingLabelSubs()&lt;/subroutinename&gt;&lt;linenumber&gt;207&lt;/linenumber&gt;&lt;primaryrc&gt;16908321&lt;/primaryrc&gt;&lt;severity&gt;64&lt;/severity&gt;&lt;secondaryrc&gt;0&lt;/secondaryrc&gt;&lt;secondaryowner&gt;0&lt;/secondaryowner&gt;&lt;flags&gt;4097&lt;/flags&gt;&lt;threadid&gt;5196&lt;/threadid&gt;&lt;procesid&gt;4940&lt;/procesid&gt;&lt;machineid&gt;KSMS1453&lt;/machineid&gt;&lt;com&gt;&lt;activityid/&gt;&lt;contextid/&gt;&lt;transactionid/&gt;&lt;/com&gt;&lt;substitutionvalues&gt;&lt;substitutionvalue index="0"&gt;26002&lt;/substitutionvalue&gt;&lt;substitutionvalue index="1"&gt;&lt;/substitutionvalue&gt;&lt;substitutionvalue index="2"&gt;CReprintServer::getShippingLabelSubs()&lt;/substitutionvalue&gt;&lt;substitutionvalue index="3"&gt;&lt;/substitutionvalue&gt;&lt;substitutionvalue index="4"&gt;ReprintServer has not been initialized!&lt;/substitutionvalue&gt;&lt;substitutionvalue index="5"&gt;0&lt;/substitutionvalue&gt;&lt;/substitutionvalues&gt;&lt;text&gt;&lt;raw&gt;&lt;normal/&gt;&lt;short/&gt;&lt;long/&gt;&lt;/raw&gt;&lt;expanded&gt;&lt;normal/&gt;&lt;short/&gt;&lt;long/&gt;&lt;/expanded&gt;&lt;/text&gt;&lt;/logrecord&gt;&lt;/logrecords&gt;&lt;/system&gt;&lt;/info&gt;&lt;/session&gt; 000008420.47006419[4940] 000008430.47006419[4940] 000008440.47118703[4940] +++&gt; 15:32:12.832 0h [RC2:0h Owner:0] Pid/Tid:4940/5196 000008450.47118703[4940] Source: Routine CReprintServer::getShippingLabelSubs(), SubRoutine:&lt;none&gt;, Line:1495 000008460.47118703[4940] Substitution Value [0]: cartonNbr = 00000999990537100272 000008470.47118703[4940] Substitution Value [1]: labelType = FXG 000008480.47118703[4940] </CODE></PRE> <P>I need to break it when ever i find 00000836 0.46880570 [4940] +++&lt; </P> <P>Props.conf , i used is </P> <PRE><CODE>BREAK_ONLY_BEFORE =\w*\s*\w\W\w*\s*[\w*]\s*\W{3} SHOULD_LINEMERGE = true </CODE></PRE> <P>But it is not breaking it properly . Please help me parse this data</P> Tue, 11 Jun 2013 23:18:31 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing/m-p/60545#M12024 tmuthuk 2013-06-11T23:18:31Z https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing/m-p/60546#M12025 <P>I would suggest using a different approach;</P> <PRE><CODE>SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d+\.\d+\[\d+\]\s+\+\+\+\S\s </CODE></PRE> <P>Which should cut on the newline before a row with '+++' in it</P> <P>Hope this helps,</P> <P>K</P> Wed, 12 Jun 2013 09:27:20 GMT https://community.splunk.com/t5/Getting-Data-In/Need-help-in-parsing/m-p/60546#M12025 kristian_kolb 2013-06-12T09:27:20Z