event breaking not happening

[pm2012]

Hi SMEs, while checking the log from one of the log source i could see logs are not ending properly and getting clubbed all together. Putting the snap below and seeking your best advice to fix it

pm2012_0-1716385064659.png

[gcusello]

Hi @pm2012,

what's the sourcetype definition for this data flow?

it seems that the LINE_BREAKING isn't configured.

Ciao.

Giuseppe

[pm2012]

Hi @gcusello 

I am sharing the below config present for this log source

pm2012_0-1716387468601.pngpm2012_1-1716387497860.png

[gcusello]

Hi @pm2012 ,

the LINE_BREAKING isn't correct.

download a sample of your data in a text file and use it in the guided procedure [Settings > Add data]

in this way, you can find the correct sourcetype definitions to use to parse your data.

Ciao.

Giuseppe

[pm2012]

HI @gcusello , I tried it using the way you suggested, it is working while uploading sample log however the same config is not working on live data. Here is the props.conf 

[ __auto__learned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]*){\"event\"\:\{\"
NO_BINARY_CHECK=true

[gcusello]

Hi @pm2012 ,

In the square brackets put the sourcetype you want to add to your data flow.

Put the props.conf file on Search Heads and on the Forwarders they are coming, and (if present) on intermediate Heavy Forwarders.

Ciao.

Giuseppe