json sourcetype failed to act correctly

[fatemebayat]

hi everyone
i have a problem with events with sourcetype=json.
when i send several logs to splunk in json format less than aorund 30s, logs aggregated in one event.
WHY?
but when i use sourcetype=json_no_timestamp, every events correct and seperated.
can i help me , how can i solve my problem?

[fatemebayat]

hi hettervi
thanks for your attention.
yes, in know it :). sourcetype is _json.
finally i solved it.
in setting -> source types -> _json, i added below setting.
-SHOULD_LINEMERGE= false
-AUTO_KV_JSON = false
-KV_MODE = none
and timestamp in auto mode and has a structure like this (Wed May 24 09:30:00.555 UTC 2017).

[hettervik]

Hi. Maybe a stupid answer, but you know it should be sourcetype=_json, and not simply json?