https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111307#M23331 <P>two things pop up here: does the sourcetype match and is your regex string on a new line?</P> Fri, 28 Mar 2014 13:25:04 GMT MuS 2014-03-28T13:25:04Z https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111306#M23330 <P>I've tried several different configurations and can't seem to get this to work. I have a log file like:</P> <PRE><CODE>"3/23/2014 4:41:16 AM - Start String" "3/23/2014 4:41:16 AM - data" "3/23/2014 4:41:16 AM - data" "3/23/2014 4:41:33 AM - data" "3/23/2014 4:41:33 AM - Finished" "3/23/2014 5:24:34 AM - Start String" </CODE></PRE> <P>I've tried a lot of different configs here was my last try:</P> <P>props.conf</P> <PRE><CODE>[sourcetype] SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = Start\sString </CODE></PRE> <P>Trying to simplify it. i previously had it BREAK_ONLY_BEFORE = regular expression date+ "start string" but it always just does one-line-per-event.</P> Mon, 28 Sep 2020 16:15:49 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111306#M23330 ngvella 2020-09-28T16:15:49Z https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111307#M23331 <P>two things pop up here: does the sourcetype match and is your regex string on a new line?</P> Fri, 28 Mar 2014 13:25:04 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111307#M23331 MuS 2014-03-28T13:25:04Z https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111308#M23332 <P>Embarassingly i didn't have the file in /etc/system/local</P> Fri, 28 Mar 2014 13:41:00 GMT https://community.splunk.com/t5/Getting-Data-In/Multiline-event-not-working/m-p/111308#M23332 ngvella 2014-03-28T13:41:00Z