How to configure Splunk to line break events into multiple lines instead of one line?

[jguzowski]

I have events coming in all in one line like:

timestamp="2017-5-19 13:00:00.000", level="INFO", machine_name="blahblah1", app="cool_app".  

I'd like to have it separate out like this:

timestamp=2017-5-19 13:00:00.000
level=INFO
machine_name=blahblah1
app=cool_app

How would I go about approaching this? I'm assuming I need to utilize props.conf and transforms.conf to do this.

[richgalloway]

I'm not sure why you would want to do this as you will lose the association between the fields. If you really want to try it, props.conf is what you need.

[mysourcetype]
LINE_BREAKER = [\r\n,]+

[woodcock]

I agree with @richgalloway. IMHO, nobody should do this BUT if you do, be aware that you will get a tone of warnings in your logs which say something like "WARN: could not find timestamp; timestamp defaulted to that of the previous event" which is exactly the correct thing to do (but you will not be able to stop the warnings).