It's hard to tell where the actual line breaks are in your file... (whether we are seeing real ones or a wrap here)
But basically you want something like this:
BREAK_ONLY_BEFORE=\d{2}\s+[JFMASOND][aepuco][nbrylgptvc]\s+\d{4}\s\d{2}:\d{2}:\d{2},\d{3}
MAX_TIMESTAMP_LOOKAHEAD=30
SHOULD_LINEMERGE=true
I have literally "spelled out" the structure of the timestamp. Being so specific is probably overkill...
However, to line break on a multiline event file. You specify something that will allow Splunk to see where to break. Tell it where the timestamp is and then tell it to merge the lines in between the "markers".
Also the way I've done it... it doesn't care about or use any actual carriage returns. However if you have them, and you can count on them showing up in a consistent place, you can use them too...
If you bring a sample into the Previewer, you will see how these things are applied.
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
