event splitting

[romantercero]

Other than props.conf, is there any other file that controls how multi-line events are split or kept together? We are having some strange issues where an event is bundled together with lines that correspond to another event on one day and then the next day having that same event type split up incorrectly in to many chunks of lines. No configuration changes have taken place in between these two occurrences so this is really odd.

Thanks!

[jbsplunk]

you may want to post more information on the specifics of the problem you're observing, I don't know that we'll be able to do much to help you without understanding what is already in props.conf and examples of the behavior in the form of sample event data.

[jbsplunk]

Line breaking is defined in props.conf, there aren't other config files that would instruct Splunk on how to deal with the data.