event cannot break line

[thangs4]

Hi everyone, I have a problem with the line-break in Splunk. I have tried following the methods as in other posts. 
Here is my props.conf
[test1:sec]
SHOULD_LINEMERGE=false
LINE_BREAKER=([\r\n]+)
NO_BINARY_CHECK=true
CHARSET=AUTO
disabled=false
TIME_FORMAT=%Y-%m-%dT%H:%M:%S.%9QZ
TIME_PREFIX=<TimeCreated SystemTime='

when I applied this sourcetype in raw windows, it work. but after I finished, it was one event


raw windows

#line-break

[PickleRick]

Where did you put your props.conf? (on which component)

And what does your ingest process look like? Because that's apparently not data from a windows eventlog input.

[KendallW]

Hi @thangs4 ,

From your second screenshot it doesn't look like the events are being parsed correctly. It looks like there wasn't a clean break between the events, and a timestamp wasn't extracted from the first event. 

Try using these settings in props.conf on your indexer/HF to explicitly break events before/after the <Event> and </Event> tags:

KV_MODE=xml
TRUNCATE = 0
SHOULD_LINEMERGE = false
LINE_BREAKER=([\r\n]+)\<Event\sxmlns
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%9QZ
TIME_PREFIX=<TimeCreated SystemTime=' 
MUST_BREAK_AFTER = \<\/Event\>
NO_BINARY_CHECK=true
CHARSET=AUTO
disabled=false

[thangs4]

Thank you for your reply,

First, let me talk a little bit about my setting. I used regex101 to check the line-break in my config. About the timestamp, it matched with all the events.

I just tried your settings, it did not work. of course, props.conf in /system/local and restart Splunk. Any other ideas, sir?

[KendallW]

Here's a couple of things to check:
1. Check the settings you have set in props.conf are actually being applied to the sourcetype:

$SPLUNK_HOME/bin/splunk cmd btool props list test1:sec

2. Check in the _internal logs for errors related to parsing for this sourcetype:

index=_internal splunk_server=* source=*splunkd.log* (component=AggregatorMiningProcessor OR component=LineBreakingProcessor OR component=DateParserVerbose) (log_level=WARN OR log_level=ERROR) data_sourcetype="test1:sec"