I am working on ingesting ADmanagerplus logs. I am having difficulty linebreaking the following log which represents one event. How can I successfully configure this so splunk recognizes this as one event and not one event per line.
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Contact Modification|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Task:Modify Single Group|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Object Name:GoofysStore|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Domain Name:acme.local|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Properties:|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: managedBy = CN=Acme,OU=Users,OU=US,DC=acme,DC=local|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: Modification Status:Successfully Updated.|
[09:10:27:548]|[01-24-2017]|[TechAudit908]|[INFO]|[9891]: **************************************************************|
