How do I configure Ironstream and/or Splunk to treat events individually, rather than aggregating events by seconds?

[kcarlin0407]

How do I configure Ironstream and/or Splunk to treat events individually, rather than aggregating events by time?
I'm sending many events per second to Splunk via Ironstream, and often there are 3 or more events getting indexed as one event.

[jeastman]

I always tell our customers to use the following parameters in their props.conf file for sourcetype=syncsortMF

SHOULD_LINEMERGE = false
LINE_BREAKER = \"}$

[lguinn2]

You probably need to set the line-breaking rules for the data in props.conf
If each event is a single line, the only setting that you probably need is

SHOULD_LINEMERGE = false

For more detailed help from the Answers community, we need to see a sample of the data stream (obfuscated of course).

You can also read more about this in the documentation: Configure event line breaking