multi line event, break with a empty line

[crazyeva]

Hi
I want to import some mussy data to splunk
every event takes multi lines
with an empty line declaring its end
likes below shows two events:
XXX XXX XXXX
XXX XXX XX

XXX XXXX XX
XXXX XX XXXXX
XX XXX
The empty line seems to be the only basis on which could be depended to break up the event
But when i "preview" this data, empty lines are filtered.

[ziegfried · Accepted solution]

These props.conf settings should help:

[mysourcetype]
SHOULD_LINEMERGE = false
LINE_BREAKER = ((?:\r?\n){2,})

[crazyeva]

exactly solved