Difficulty with linemerge and break_only

[cwwirth]

I'm trying to get the following lines, all in the same text file on a Windows server, to show up as a single event in Splunk:

11/25/2013  12:00:10 PM     Engine version                          =   5600.1067
11/25/2013  12:00:10 PM     AntiVirus   DAT version                 =   7271.0
11/25/2013  12:00:10 PM     Number of detection signatures in EXTRA.DAT =   None
11/25/2013  12:00:10 PM     Names of detection signatures in EXTRA.DAT  =   None
11/25/2013  12:00:10 PM Scan Started    DOMAIN\PRINTING$    (managed) Server Full scan
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Scan Summary
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Processes scanned    : 49
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Processes detected   : 0
11/25/2013  2:22:23 PM  Scan Summary    DOMAIN\PRINTING$    Processes cleaned    : 0\

On the source server, I have an inputs.conf stanza calling out that file as its own sourcetype:

[monitor://c:\ProgramData\McAfee\DesktopProtection\OnDemandScanLog.txt]
sourcetype = McAfeeOnDemandScan

And on the indexer, I have a stanza in props.conf to (try) to merge these all into one event, breaking at the first line ("Engine" appears only in the first line in the file):

[McAfeeOnDemandScan]
SHOULD_LINEMERGE = True
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = Engine

...yet each line still appears as its own event. Would anyone be so kind as to point me in the right direction?

Thanks!

[emechler_splunk · Accepted solution]

This props.conf stanza worked great for me using your data sample:

[McAfeeOnDemandScan]
BREAK_ONLY_BEFORE=^\d+/\d+/\d+\s+\d+:\d+:\d+\s+Engine
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

[cwwirth]

Yep, that works great for me too. Thanks!

[aelliott]

if they all start with a date and "engine version" you could potentially set it up to break only before a regex of the date and word Engine