Configure BREAK_ONLY_BEFORE

[Azwaliyana]

I just want to configure BREAK_ONLY_BEFORE. When I save the source type, it automatically adds LINE_BREAKER. I do not want the LINE_BREAKER to be there as it will remove the regex that I have specified in BREAK_ONLY_BEFORE. I have done many things. 

I want it to be like this.

Azwaliyana_0-1635827337188.png

But when I save it, Splunk automatically add the regex that I have specified for BREAK_ONLY_BEFORE as LINE_BREAKER. And the result is like this. Splunk remove the pg-2

Azwaliyana_1-1635827483476.png

What should I do to keep my regex not being removed by Splunk but I want it to split into another event?

[richgalloway]

How are you saving the settings?  I've never seen Splunk automatically add LINE_BREAKER before.  What version of Splunk are you using?

[Azwaliyana]

I click on Save As button that appears here which is for the source type after uploading the file. 

Azwaliyana_0-1636517376531.png

Do you have any solutions for this? I use Splunk 8.1.3