I want to chop multiline events like below. I had splunk to automatically process the data, but it didn't quite work where the event started with "Begin_Event".
How can I define custom event separation rule so that the each evens starts after "Begin_Event" tag?
environmentFailureEvent - EAS - KG-079, Cab 1, Pos 1, active ACG, EAS 0 - May 3, 2010 00:02:55.
 Rectifier Module Fail - Clear
processingFailureEvent - IHLR_ALARM_APP - KTIHLR1_B, IHLR_ALARM_APP 1 - May 3, 2010 00:02:49.
 Subscriber Not In iDEN HLR - Minor.