Logs parses fine during the day but groups multiple entries together from midnight - 1am

[king2jd]

[skoelpin]

Can you post your props.conf which is located on your indexer(s) under $SPLUNK_HOME/etc/system/local?

[king2jd]

We are using the settings from the /opt/splunk/etc/system/default/props.conf

[skoelpin]

Did you copy and paste the default settings to your local settings?

I would recommend you create a new props.conf under $SPLUNK_HOME/etc/system/local

[source::YOUR_SOURCE_PATH]
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S,$3N
MAX_TIMESTAMP_LOOAKAHEAD = 30
LINE_BREAKER = \[\d\/\d+\/\d+\s\d\:\d+\:\d+\:\d+\sEDT\]
SHOULD_LINEMERGE = false
TRUNCATE = false