linebreaker not working

[surekhasplunk]

{"alarm": {"attribute": [{"@id": "0x10000", "$": "SwCiscoIOS"}, {"@id": "0x11d42", "$": "tfotaprdhkap002"}, {"@id": "0x12022", "$": "0"}, {"@id": "0x12c05", "$": "Directly Managed"}, {"@id": "0x13345", "$": "0"}, {"@id": "0x12a07", "$": "0"}, {"@id": "0x12a06", "$": "0"}, {"@id": "0x1000a", "$": "2"}, {"@id": "0x11f4d", "$": "false"}, {"@id": "0x12b4c", "$": "AGENT SNMP NOT RESPONDING TO POLLS"}, {"@id": "0x11f4e", "$": "1568288097"}, {"@id": "0x1006e", "$": "sacctok0602.jp.world.socgen"}, {"@id": "0x11f50", "$": "67329"}, {"@id": "0x11f57", "$": "true"}, {"@id": "0x11f56", "$": "2"}, {"@id": "0x11f9b", "$": "false"}, {"@id": "0x129fa", "$": "0x92833e"}, {"@id": "0x11f9c", "$": "5d7a2d61-f9ca-1567-035e-00801005f81c"}, {"@id": "0x12d7f", "$": "176.3.250.18"}], "@id": "5d7a2d61-f9ca-1567-035e-00801005f81c"}, "@preexisting": false}, {"alarm": {"attribute": [{"@id": "0x10000", "$": "SwCiscoIOS"}, {"@id": "0x11d42", "$": "psehlx20"}, {"@id": "0x12022", "$": "0"}, {"@id": "0x12c05", "$": "Directly Managed"}, {"@id": "0x13345", "$": "0"}, {"@id": "0x12a07", "$": "0"}, {"@id": "0x12a06", "$": "0"}, {"@id": "0x1000a", "$": "0"}, {"@id": "0x11f4d", "$": "false"}, {"@id": "0x12b4c", "$": "TRAP LINK DOWN IS RECEIVED"}, {"@id": "0x11f4e", "$": "1568288101"}, {"@id": "0x1006e", "$": "PDC-SW-N47_01.eu.newedge.int"}, {"@id": "0x11f50", "$": "2228225"}, {"@id": "0x11f57", "$": "true"}, {"@id": "0x11f56", "$": "1"}, {"@id": "0x11f9b", "$": "true"}, {"@id": "0x129fa", "$": "0x1b30db"}, {"@id": "0x11f9c", "$": "5d7a2d65-d81a-1dba-031e-008010400a87"}, {"@id": "0x12d7f", "$": "195.118.1.40"}], "@id": "5d7a2d65-d81a-1dba-031e-008010400a87"}, "@preexisting": false},

it should break at {"alarm":

[gcusello]

Hi surekhasplunk,
what's your architecture: have you an Heavy Forwarder or not?
where do you locate the props.conf?

props.conf must be located on Indexers and (if present) on Heavy Forwarders.

Bye.
Giuseppe

[harsmarvania57]

Duplicate of https://answers.splunk.com/answers/771915/index-time-not-getting-captured-correctly.html

[richgalloway]

What are the current props.conf settings for this sourcetype?
Have you tried LINE_BREAKER = (){"alarm":?

[surekhasplunk]

yes line break is happening but taking only 1 event not all