Multiple events are coming into a single event

[AshimaGupta1991]

When ingesting Guardicore logs into Splunk. Multiple events are being combined into a single event. Date marks the beginning of a new event and I want to separate each event.

Sample Logs:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Origin: xxxxx-xxxxx-xxxx-1xxx-1xxxxxxxxxxxxx
Affected Agents: xxxxxxxxxx(ip: xx:x:xx:xxx, component_id: None)
Message: Agent installation of ‘xxxxxxxxxxx’ was successful
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Origin: Management
Affected Agents: xxxxxxxxx (ip: None, component_id: xxxxxxxxxx-xxxxx)
Message: Agent was removed upon expiry
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Origin: Management
Affected Agents:xxxxxxxxx (ip: xxxxxxxxxx, component_id: None),cccccccccccxxxxxxx (ip: xx:xx:xx:xxxx, component_id: None)Message: Received network event with unknown xxxxxx
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Expected outcome:
Event 1:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Origin: xxxxx-xxxxx-xxxx-1xxx-1xxxxxxxxxxxxx
Affected Agents: xxxxxxxxxx(ip: xx:x:xx:xxx, component_id: None)
Message: Agent installation of ‘xxxxxxxxxxx’ was successful

Event 2:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Origin: Management
Affected Agents: xxxxxxxxx (ip: None, component_id: xxxxxxxxxx-xxxxx)
Message: Agent was removed upon expiry

Event 3:
Apr 17 15:06:32 xx.xxx.xx.xxx New agent log

Origin: Management
Affected Agents:xxxxxxxxx (ip: xxxxxxxxxx, component_id: None),cccccccccccxxxxxxx (ip: xx:xx:xx:xxxx, component_id: None)Message: Received network event with unknown xxxxxx

[to4kawa]

props.conf

BREAK_ONLY_BEFORE_DATE = [true|false]
* When set to true, Splunk software creates a new event only if it encounters 
  a new line with a date.
  * Note, when using DATETIME_CONFIG = CURRENT or NONE, this setting is not
    meaningful, as timestamps are not identified.
* Defaults to true.

What's your props.conf ?