https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-parse-multiple-logs-as-individual/m-p/249676#M48044 <P>Hello –</P> <P>New to Splunk. I’ve searched the community, but may not be using the correct wording to find an answer. See the example below of a log file I’m feeding into Splunk. Each event starts at the time stamp and ends after the “blah, blah”. When I search the log in Splunk, it’s showing multiple events together. How do I go about getting Splunk to see them as individual events?</P> <PRE><CODE>09:16:54,126 DEBUG [Thread-1646678] Version: 0.2 Message Format: X12 Message Type: 271_Response_005010X279A1 Status: Body Length: 2128 ISA blah blah blah ect 09:18:57,357 DEBUG [Thread-1646478] Version: 0.2 Message Format: X12 Message Type: 271_Response_005010X279A1 Status: Body Length: 2128 ISA blah blah blah ect </CODE></PRE> Fri, 08 Jul 2016 13:44:38 GMT cj039165 2016-07-08T13:44:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-parse-multiple-logs-as-individual/m-p/249676#M48044 <P>Hello –</P> <P>New to Splunk. I’ve searched the community, but may not be using the correct wording to find an answer. See the example below of a log file I’m feeding into Splunk. Each event starts at the time stamp and ends after the “blah, blah”. When I search the log in Splunk, it’s showing multiple events together. How do I go about getting Splunk to see them as individual events?</P> <PRE><CODE>09:16:54,126 DEBUG [Thread-1646678] Version: 0.2 Message Format: X12 Message Type: 271_Response_005010X279A1 Status: Body Length: 2128 ISA blah blah blah ect 09:18:57,357 DEBUG [Thread-1646478] Version: 0.2 Message Format: X12 Message Type: 271_Response_005010X279A1 Status: Body Length: 2128 ISA blah blah blah ect </CODE></PRE> Fri, 08 Jul 2016 13:44:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-parse-multiple-logs-as-individual/m-p/249676#M48044 cj039165 2016-07-08T13:44:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-parse-multiple-logs-as-individual/m-p/249677#M48045 <P>Splunk distinguishes each event based on the LINE_BREAKER property set for that sourcetype in props.conf. props.conf should be on your indexer(s)</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/6.4.1/Admin/Propsconf</A></P> Fri, 08 Jul 2016 17:28:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-configure-Splunk-to-parse-multiple-logs-as-individual/m-p/249677#M48045 pradeepkumarg 2016-07-08T17:28:54Z