Hi, Want to break event using line_breaker property.

[shinde0509]

2017-04-02 22:45:19.023 -0600 so-splunky.local sshd[68061]: Accepted keyboard-interactive/pam for sowings from xx.xx.xx.xx port xx ssh2
2017-04-02 23:45:23.142 -0500 so-splunky.local sshd[68608]: Accepted keyboard-interactive/pam for sowings from xx.xx.xx.xx port xx ssh2

[woodcock]

Make sure that you are NOT setting SHOULD_LINEMERGE=true and keep the default (do not specify any LINE_BREAKER=).

[cleelakrishna]

in props.conf for particular stanza use this attribute , where which events you want to break

LINE_BREAKER = ([\r\n]+)

[jimodonald]

It looks like a new line is the event breaker. Splunk should detect that on it's own, but you can try:

LINE_BREAKER = ([\r\n]+)