https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80096#M16481 <P>you may want to post more information on the specifics of the problem you're observing, I don't know that we'll be able to do much to help you without understanding what is already in props.conf and examples of the behavior in the form of sample event data.</P> Tue, 28 Feb 2012 17:47:33 GMT jbsplunk 2012-02-28T17:47:33Z https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80094#M16479 <P>Other than props.conf, is there any other file that controls how multi-line events are split or kept together? We are having some strange issues where an event is bundled together with lines that correspond to another event on one day and then the next day having that same event type split up incorrectly in to many chunks of lines. No configuration changes have taken place in between these two occurrences so this is really odd.</P> <P>Thanks!</P> Tue, 28 Feb 2012 02:05:57 GMT https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80094#M16479 romantercero 2012-02-28T02:05:57Z https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80095#M16480 <P>Line breaking is defined in props.conf, there aren't other config files that would instruct Splunk on how to deal with the data. </P> Tue, 28 Feb 2012 17:45:39 GMT https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80095#M16480 jbsplunk 2012-02-28T17:45:39Z https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80096#M16481 <P>you may want to post more information on the specifics of the problem you're observing, I don't know that we'll be able to do much to help you without understanding what is already in props.conf and examples of the behavior in the form of sample event data.</P> Tue, 28 Feb 2012 17:47:33 GMT https://community.splunk.com/t5/Getting-Data-In/event-splitting/m-p/80096#M16481 jbsplunk 2012-02-28T17:47:33Z