A common trouble with JSON data. Can you share your some sample data? Please mask any sensitive data like IP addresses or anything related to your company, as its risky and usually leads to the question being deleted. If that's not possible, try modifying snd implementing something like this in your props.conf.
[Your_sourcetype]
KVMODE=json
LINEBREAKER= your_regex_to_identify_the_whitespace_between_closing_and_opening_braces_of_first_and_second_events
MAXTIMESTAMPLOOKAHEAD=30
NOBINARYCHECK=true
SHOULDLINEMERGE=false
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
