The following event being parsed as single event. I'm trying to break the event into multiple events
Sample data
Timestamp: 2021.09.21 - 23:10:17.463
Message: c0d8758b-3fxy-44ca-aa65-hf180002d499
Organization Name: bananaII
UserId: systemuser
AppTracking: abcd2400-34ac-50el-3456-4abcd7636
------------------- CommonMessageInput ----------------
Timestamp: 2021.09.21 - 23:10:17.463
Message: c0d8758b-3fxy-44ca-aa65-hf180002d499
Organization Name: bananaII
UserId: systemuser
AppTracking: abcd2400-34ac-50el-3456-4abcd7636
------------------- CommonMessageInput ----------------
Timestamp: 2021.09.21 - 23:10:17.463
Message: c0d8758b-3fxy-44ca-aa65-hf180002d499
Organization Name: bananaII
UserId: systemuser
AppTracking: abcd2400-34ac-50el-3456-4abcd7636
I'm trying to break the event before ------------------- CommonMessageInput ---------------- so the events will be
Event 1
Timestamp: 2021.09.21 - 23:10:17.463
Message: c0d8758b-3fxy-44ca-aa65-hf180002d499
Organization Name: bananaII
UserId: systemuser
AppTracking: abcd2400-34ac-50el-3456-4abcd7636
Event 2
------------------- CommonMessageInput ----------------
Timestamp: 2021.09.21 - 23:10:17.463
Message: c0d8758b-3fxy-44ca-aa65-hf180002d499
Organization Name: bananaII
UserId: systemuser
AppTracking: abcd2400-34ac-50el-3456-4abcd7636
Event 3
------------------- CommonMessageInput ----------------
Timestamp: 2021.09.21 - 23:10:17.463
Message: c0d8758b-3fxy-44ca-aa65-hf180002d499
Organization Name: bananaII
UserId: systemuser
AppTracking: abcd2400-34ac-50el-3456-4abcd7636
It's been a minute since I've been a splunk admin, so fairly rusty here....but I think you might want something like this in your props.
[your_sourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y.%m.%d - %H:%M:%S.%3N
TIME_PREFIX = Timestamp:
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=-{10})