We have 2 large datafeeds into Splunk, email and SQL Trace outputs, but the CRLF characters in both feeds are creating more than 3 times as many Events as there are actual records (individual emails or trace records). What is the best practice for this? Firstly - to preserve the line break, but not confuse Splunk. And secondly, how do we deal with the already existing in Splunk?
Thank you very much in advance!