Log4j events line-break not consistent

[banderson7]

I'm bringing in alfresco logs, in this case share.log and for the most part the events are broken up by line correctly

09:30:32,256 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]      Nothing to push to Solr

, until they're not

09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] 
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Processing 0 orphaned content
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]    Processing Deletes: 0
09:30:42,405 DEBUG [com.XXXXX.alfresco.services.search.AbstractSolrService]      Nothing to push to Solr
09:30:42,405 INFO  [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco-Solr Sync Alfresco Stats: Total Folders: 737; Total Documents: 44587
09:30:42,405 INFO  [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco-Solr Sync Solr Stats: Already In Solr: 44586; Created: 1; Updated: 0; Removed: 0; Orphaned: 0
09:30:42,413 DEBUG [com.XXXXX.alfresco.services.search.sync.AlfrescoToSolrSyncTrackerComponent] Alfresco To Solr Push Sync: Job finished

My props is thus:

[XXXXXX:uat:alfresco]
LINE_BREAKER = ([\r\n]+)
#BREAK_ONLY_BEFORE = \d\d?:\d\d:\d\d
pulldown_type = true
maxDist = 75
category = Application

Neither line breaker nor BREAK_ONLY_BEFORE have worked on this correctly. What am I doing wrong? Thanks

[woodcock · Accepted solution]

You need to add this (defaults to true; keep everything else as you showed it:

SHOULD_LINEMERGE=false

[banderson7]

No change, unfortunately.

[woodcock]

You have to restart splunk on all the indexers and it will only effect NEWLY INDEXED events.

[banderson7]

So this is not a search time property addition? Ok, thanks.

[woodcock]

That is correct.

[richgalloway]

What seems to be the problem? The line breaks look OK to me. Or is the second example a single event?

[banderson7]

The second example shows as one event but it's 7 events in the log.