https://community.splunk.com/t5/Getting-Data-In/Why-is-linebreaking-not-working-for-Microsoft-DHCP-failover-auto/m-p/432511#M75657 <P>can you try SHOULD_LINEMERGE=true in your stanza else try:-</P> <PRE><CODE>[dfacs] LINE_BREAKER = (====+) MAX_TIMESTAMP_LOOKAHEAD=22 NO_BINARY_CHECK=true SHOULD_LINEMERGE=true TIME_FORMAT=%m/%d/%Y %H:%M:%S TIME_PREFIX=Sync\sprocess\scomplete\sat\s TZ=US/Eastern disabled=false </CODE></PRE> <P>and after changing props.conf change will affect later indexed events and it will not affect already indexed events.</P> Mon, 22 Oct 2018 17:55:18 GMT 493669 2018-10-22T17:55:18Z https://community.splunk.com/t5/Getting-Data-In/Why-is-linebreaking-not-working-for-Microsoft-DHCP-failover-auto/m-p/432510#M75656 <P>Swinging back around to an issue that has me a bit confused. Microsoft DHCP Failover Auto Config Sync generates logs like the following:</P> <P>==================================================================================================<BR /> Sync process complete at 01/25/2018 17:04:08.</P> <H1>Will automatically sync again when new configuration changes are made.</H1> <P>Sync process complete at 01/25/2018 17:11:16.</P> <H1>Will automatically sync again when new configuration changes are made.</H1> <P>Periodic Sync TimeOut Happened:</P> <PRE><CODE>Syncing Relation:DHCP1-DHCP2 Sync process complete at 01/25/2018 17:26:17. </CODE></PRE> <P>I've created a custom source type, shown below:</P> <PRE><CODE>[dfacs] TRUNCATE = 999999 LINE_BREAKER = (=+[\r\n]+) MAX_TIMESTAMP_LOOKAHEAD=22 NO_BINARY_CHECK=true SHOULD_LINEMERGE=false TIME_FORMAT=%m/%d/%Y %H:%M:%S TIME_PREFIX=Sync\sprocess\scomplete\sat\s TZ=US/Eastern disabled=false </CODE></PRE> <P>My main frustration is that, for some reason, it separates the following the 3-line section into 2 events with EVENT1 being given a timestamp ~ 3 seconds before EVENT2 is properly timestamped:</P> <PRE><CODE> Periodic Sync TimeOut Happened: Syncing Relation:DHCP1-DHCP2 Sync process complete at 01/22/2018 11:37:02. --EVENT1-- Periodic Sync TimeOut Happened: Syncing Relation:DHCP1-DHCP2 --EVENT2-- Sync process complete at 01/22/2018 11:37:02. </CODE></PRE> <P>Based on the props, I did intend to remove the lines with "="'s. As the 2-line events break fine, any suggestions on how to stop the 3-line events from breaking?</P> Mon, 22 Oct 2018 17:42:24 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-linebreaking-not-working-for-Microsoft-DHCP-failover-auto/m-p/432510#M75656 joeburris 2018-10-22T17:42:24Z https://community.splunk.com/t5/Getting-Data-In/Why-is-linebreaking-not-working-for-Microsoft-DHCP-failover-auto/m-p/432511#M75657 <P>can you try SHOULD_LINEMERGE=true in your stanza else try:-</P> <PRE><CODE>[dfacs] LINE_BREAKER = (====+) MAX_TIMESTAMP_LOOKAHEAD=22 NO_BINARY_CHECK=true SHOULD_LINEMERGE=true TIME_FORMAT=%m/%d/%Y %H:%M:%S TIME_PREFIX=Sync\sprocess\scomplete\sat\s TZ=US/Eastern disabled=false </CODE></PRE> <P>and after changing props.conf change will affect later indexed events and it will not affect already indexed events.</P> Mon, 22 Oct 2018 17:55:18 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-linebreaking-not-working-for-Microsoft-DHCP-failover-auto/m-p/432511#M75657 493669 2018-10-22T17:55:18Z