There seems to be two problems. First the output of your logs has unwanted carriage returns in it. The second splunk is not recognising this as a multiline event. The latter can be fixed with the following stanza in props.conf. The time prefix looks complex but it is saying look for a line that starts with [ and the time should come after the second [
[business] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true TIME_PREFIX = ^\[[^\+\[ TIME_FORMAT = %Y-%m-%d %H:%M:%S,%q3 MAX_TIMESTAMP_LOOKAHEAD = 24
The line breaks will still be there and may cause fields to break in half. I suggest you look at how these logs are generated for the cause.