https://community.splunk.com/t5/Dashboards-Visualizations/line-breaking/m-p/86773#M4722 <P>Need to break a log file into multiple events while indexing if there are no newline characters<BR /> sample log file data: <BR /> \xE1\xA\x01\x00RFD \x00\x00\x00\x1\x00\x00\x7\x00\x00\x00\x3\x11\x00\x00\x33MQSIR \x00\x00\x00\x00\x00\x00\x4\xB8\x00\x00\x01H<PSC><CMD>Test</CMD><TOPIC>INF/LI/Item/Tested</TOPIC></PSC> \x00\x00\x6\x7C<CONTEXT>Y</CONTEXT><TESTTYPE>SRINATH </TESTTYPE> 00000153311234ABCD 2013-10-03-02.33.51.750348ANDHRA IND AP 12.123+ 12.123+ <STRONG>\xE2\xB\x02\x00RFO</STRONG> \x00\x00\x00\x2\x00\x00\x7\x00\x00\x00\x3\x12\x00\x00\x34MQSJR \x00\x00\x00\x00\x00\x00\x4\xB8\x00\x00\x02H<PSC><CMD>Test</CMD><TOPIC>INF/LI/Item/Tested</TOPIC></PSC> \x00\x00\x6\x8C<CONTEXT>Y</CONTEXT><TESTTYPE>SRINATH </TESTTYPE> 00001483531234ABCD 2013-10-03-02.33.52.033155ANDHRA IND AP 12.123+ 12.123+</P> <P>Highlighted text is the starting of second event in the log</P> Tue, 08 Oct 2013 11:21:35 GMT srinathd 2013-10-08T11:21:35Z https://community.splunk.com/t5/Dashboards-Visualizations/line-breaking/m-p/86773#M4722 <P>Need to break a log file into multiple events while indexing if there are no newline characters<BR /> sample log file data: <BR /> \xE1\xA\x01\x00RFD \x00\x00\x00\x1\x00\x00\x7\x00\x00\x00\x3\x11\x00\x00\x33MQSIR \x00\x00\x00\x00\x00\x00\x4\xB8\x00\x00\x01H<PSC><CMD>Test</CMD><TOPIC>INF/LI/Item/Tested</TOPIC></PSC> \x00\x00\x6\x7C<CONTEXT>Y</CONTEXT><TESTTYPE>SRINATH </TESTTYPE> 00000153311234ABCD 2013-10-03-02.33.51.750348ANDHRA IND AP 12.123+ 12.123+ <STRONG>\xE2\xB\x02\x00RFO</STRONG> \x00\x00\x00\x2\x00\x00\x7\x00\x00\x00\x3\x12\x00\x00\x34MQSJR \x00\x00\x00\x00\x00\x00\x4\xB8\x00\x00\x02H<PSC><CMD>Test</CMD><TOPIC>INF/LI/Item/Tested</TOPIC></PSC> \x00\x00\x6\x8C<CONTEXT>Y</CONTEXT><TESTTYPE>SRINATH </TESTTYPE> 00001483531234ABCD 2013-10-03-02.33.52.033155ANDHRA IND AP 12.123+ 12.123+</P> <P>Highlighted text is the starting of second event in the log</P> Tue, 08 Oct 2013 11:21:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/line-breaking/m-p/86773#M4722 srinathd 2013-10-08T11:21:35Z https://community.splunk.com/t5/Dashboards-Visualizations/line-breaking/m-p/86774#M4723 <P>You can try setting the line breaker in props.conf. This regex will look for whitespace at least 35 characters long, and then split the line. This will require a restart of Splunk.</P> <P><CODE>[my_sourcetype]<BR /> LINE_BREAKER = (\s{35,})</CODE></P> Tue, 08 Oct 2013 13:12:44 GMT https://community.splunk.com/t5/Dashboards-Visualizations/line-breaking/m-p/86774#M4723 alacercogitatus 2013-10-08T13:12:44Z