Splunk is dismissing everything in the event prior to the field
When I search Splunk, the event is displaying as:
Since each field is outputted as a new line, I assume splunk thinks the epoch=timestamp line is a new event. Thus, indexes from that point. I cannot figure out how to get the entire event indexed. I want Splunk to use the date timestamp at the beginning of the event (2014-04-29 17:23:00,428) to determine the start of a multi-line event.
I have tried to add the following to the props.conf file but no luck: