Cannot get logs from specific source to seperate by line

[Ghostoverflow25]

I have a source of logs that I want to ingest into splunk, where each line documents a seperate event. After having set it up, I noticed my old logs are not being ingested, so I ran:

`/opt/splunkforwarder/bin/splunk spool /root/.local/share/HellPot/logs/HellPot_03_Apr_25_07-52_UTC.log -index hellpot`

This however leads to multiple lines being detected as the same event in splunk. E.g.:

4/21/25 10:49:28.000 PM

{"level":"info","USERAGENT":"ct‑git‑scanner/0.4","REMOTE_ADDR":"<>","URL":"/.git/config","time":"2025-04-21T12:49:28Z","message":"NEW"} {"level":"info","USERAGENT":"ct‑git‑scanner/0.4","REMOTE_ADDR":"<>","URL":"/.git/config","BYTES":273794502,"DURATION":9992.439466,"time":"2025-04-21T12:49:38Z","message":"FINISH"} {"level":"info","USERAGENT":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36","REMOTE_ADDR":"<>","URL":"/cms/wp-includes/wlwmanifest.xml","time":"2025-04-21T14:15:29Z","message":"NEW"} {"level":"info","USERAGENT":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36","REMOTE_ADDR":"<>","URL":"/cms/wp-includes/wlwmanifest.xml","time":"2025-04-21T15:15:09Z","message":"NEW"} {"level":"info","USERAGENT":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36","REMOTE_ADDR":"<>","URL":"/cms/wp-includes/wlwmanifest.xml","BYTES":2174287196,"DURATION":4863712.933262,"time":"2025-04-21T15:36:32Z","message":"FINISH"}

Whereas I'd expect each json line to be a different event.

My props.conf has disabled line merging:

```

[default]
SHOULD_LINEMERGE = false
LINE_BREAKER = \n
KV_MODE = json

```

And I both restarted the universal forwarder and ran `| extract reload=T` on my main instance.

If I let the logs "trickle in" one by one it imports fine, with the caviet that it of course cannot include any of the prior data.

I'm kind of lost at this point on how to get the logs to properly separate, so would appreciate some guidance...

[vjdev · Accepted solution]

Hello,

TRY BELOW:

INDEXED_EXTRACTIONS=JSON
KV_MODE=none
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
TIME_PREFIX=\"time\"\:\"
TIME_FORMAT=%Y-%m-%dT%T
MAX_TIMESTAMP_LOOKAHEAD=21

Thank You!