https://community.splunk.com/t5/Splunk-Enterprise-Security/Line-Breake-issue/m-p/498962#M8713 <P>Could you provide me how it can write line break and Time regex below logs .</P> <P>2020-09-26 19:27:33,092 DEBUG com.edifecs.shared.rmi.RMISocketFactoryInitializer - Initialize custom rmiSocketFactory...\n2014-09-26 19:27:33,983 DEBUG com.edifecs.shared.events.transport.rmi.RmiEventBusBuilder - Building EventBus instance for parameters: [eventBusID=EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}, rmiConfigurer=com.edifecs.shared.registry.RMIConfigurer@a9255c, remoteEventBusAddresses=[rmi://TEDITM01:1090/EventBus, rmi://TXENGN01:1090/EventBus, rmi://BCKCMD1:1090/EventBus], serverMode=true]\n2014-09-26 19:27:34,155 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Web Component/TEDITM01 {5ba842c9-9310-4342-9362-e63d8a964605}\n2014-09-26 19:27:34,186 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] local bus started up\n2014-09-26 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - Failed to obtain a reference to remote EventBus. Connection to rmi://BCKCMD1:1090/EventBus refused.\n2014-09-26 19:27:35,921 DEBUG com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - java.rmi.ConnectException: Connection refused to host: BCKCMD1; nested exception is: \n java.net.ConnectException: Connection refused: connect\n2014-09-26 19:27:37,655 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Service Manager/TEDITM01 {20f1a2e4-14d7-40e0-85b1-7462173ac1c3}</P> Sun, 07 Jun 2020 16:08:37 GMT khalidewaidah 2020-06-07T16:08:37Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Line-Breake-issue/m-p/498962#M8713 <P>Could you provide me how it can write line break and Time regex below logs .</P> <P>2020-09-26 19:27:33,092 DEBUG com.edifecs.shared.rmi.RMISocketFactoryInitializer - Initialize custom rmiSocketFactory...\n2014-09-26 19:27:33,983 DEBUG com.edifecs.shared.events.transport.rmi.RmiEventBusBuilder - Building EventBus instance for parameters: [eventBusID=EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}, rmiConfigurer=com.edifecs.shared.registry.RMIConfigurer@a9255c, remoteEventBusAddresses=[rmi://TEDITM01:1090/EventBus, rmi://TXENGN01:1090/EventBus, rmi://BCKCMD1:1090/EventBus], serverMode=true]\n2014-09-26 19:27:34,155 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Web Component/TEDITM01 {5ba842c9-9310-4342-9362-e63d8a964605}\n2014-09-26 19:27:34,186 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] local bus started up\n2014-09-26 19:27:35,921 INFO com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - Failed to obtain a reference to remote EventBus. Connection to rmi://BCKCMD1:1090/EventBus refused.\n2014-09-26 19:27:35,921 DEBUG com.edifecs.shared.events.transport.rmi.RmiBusesPublisher - java.rmi.ConnectException: Connection refused to host: BCKCMD1; nested exception is: \n java.net.ConnectException: Connection refused: connect\n2014-09-26 19:27:37,655 INFO com.edifecs.shared.events.EventBus - [EventBus: EventBus|Service Manager/TEDITM01 {4ec992e0-ac7d-4b45-af5c-8d81cdb683b6}] registered remote bus: EventBus|Service Manager/TEDITM01 {20f1a2e4-14d7-40e0-85b1-7462173ac1c3}</P> Sun, 07 Jun 2020 16:08:37 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Line-Breake-issue/m-p/498962#M8713 khalidewaidah 2020-06-07T16:08:37Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Line-Breake-issue/m-p/498963#M8714 <P>Hi <BR /> It is hard to tell if this should be a single event, or if it is multiple events.</P> <P>Assuming this is multiple events broken on a \n followed by date, the following should work</P> <P>props.conf </P> <P>[ mysourcetype]<BR /> SHOULD_LINEMERGE=false<BR /> LINE_BREAKER=(\n)\d{4}<BR /> NO_BINARY_CHECK=true<BR /> TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N</P> Wed, 30 Sep 2020 05:24:53 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Line-Breake-issue/m-p/498963#M8714 michael_bates_1 2020-09-30T05:24:53Z