How do I line break after a particular word?

[vrmandadi]

Hello
Below is a sample one sample event which starts with ####### and ends with * All done!. How do I break the events correctly?
Thanks in advance

#######################
Program: FADBDataLoader.pl
Begin Processing: Mon Aug 27 09:38:15 2018
Executing from: linuxbatch-prod
Working Directory: /opt/apps/FADB/Support

Command:  FADBDataLoader.pl 
No override date provided from command-line.
Will use database override OR date card file instead.

Connecting to fadbprd as ... success!

Calling 'GMRUSER.CHECK_OVERRIDE_DATE' to get possible override process date
execProcCursor(): Executing GMRUSER.CHECK_OVERRIDE_DATE with 3 parameters
    (FADB_UX_SS_MMKT_FNAV_LOAD, SSB, <cursor>)

Procedure returned value: 

No date found in database table...
Process date file:  /opt/apps/FADB/Support/process_date_am.dat
Process date:       08/27/2018
Control Date will be checked against Processing Date
Validating data file with LMFadbUtils::validate_ssmmkt_fnav_intraday routine...
Calling 'GMRUSER.SSB_MMKT_FNAV_LOAD' to load data.
ExecProc(): Executing GMRUSER.SSB_MMKT_FNAV_LOAD with 4 parameters
    (20180827, SSB, FADB_UX_SS_MMKT_FNAV_LOAD,  )

Parsing the database output...
* Begin Money Market FNAV load into FADB.TBL_FNAV_INTRADAY
* from GMRUSER.STAGE_MMR_FNAV
* of 4 stage records for SSB (2) 
* dated 27 Aug 2018
* Updated 4 of 4 custodian IDs. within staging table.
* Strike time found: 0800
* Updating control date in stage table...
* Updated 4 of 4 Account IDs within staging table.
* Updated 4 of 4 instrument IDs. within staging table.
* Number of prior run records to be deleted: 0
* Inserted 4 of 4 rows into FADB.TBL_FNAV_INTRADAY.

Sending Rejections
execProcCursor(): Executing GMRUSER.GET_REJECTIONS with 4 parameters
    (08/27/2018, FADB_UX_SS_MMKT_FNAV_LOAD, 2, <cursor>)

No Rejections Found.
ExecProc(): Executing GMRUSER.BO_REPORT_JOB_STATUS_INS with 2 parameters
    (08/27/2018, FADB_UX_SS_MMKT_FNAV_LOAD)

execProcCursor(): Executing GMRUSER.BO_REPORT_JOB_STATUS_CHECK with 3 parameters
    (08/27/2018, FADB_UX_SS_MMKT_FNAV_LOAD, <cursor>)

ExecProc(): Executing GMRUSER.BO_REPORT_JOB_STATUS_UPD with 2 parameters
    (08/27/2018, FADB_UX_SS_MMKT_FNAV_LOAD)

Calling 'FADB.GET_FEED_FILE_ARCH_FLAG' to get mult. archive flag
execProcCursor(): Executing FADB.GET_FEED_FILE_ARCH_FLAG with 2 parameters
    (FADB_UX_SS_MMKT_FNAV_LOAD, <cursor>)




--------------------------------------------------------------------------------


### DATABASE LOGGING INFORMATION ###

Job Name:   FADB_UX_SS_MMKT_FNAV_LOAD
Batch ID:   SSB
Process Date:   08/27/2018
JOB_ID:     741
RUN_NUMBER: 1

* Inserting log for STDOUT output to database...
* Inserted 99 rows into the table for run number 1
* Inserting log for STDERR output to database...
* Inserted 21 rows into the table for run number 1
* All done!

[mstjohn_splunk]

hi @vrmandadi,

Did the answer below solve your question? If yes, please click “Accept” directly below the answer to resolve the post. If not, please comment with more information if you are still having issues.

[richgalloway · Accepted solution]

Try this in your props.conf:

LINE_BREAKER = (#######################)
SHOULD_LINEMERGE = true
TIME_PREFIX = Begin Processing: 
TIME_FORMAT = %a %b %d %H:%M:%S %Y

[pruthvikrishnap]

try adding this props.conf
[sourcetype]
NO_BINARY_CHECK = true
BREAK_ONLY_BEFORE =

[skoelpin]

LINE_BREAKER is better than BREAK_ONLY_BEFORE