Event separation is not working properly?

[karthi2809]

Event separation is not working properly ?

Merged log:

[10/27/17 0:58:53:702 EDT] 0000013b TimerLog 1 com.ibm.mdm.mds.log.Adapter log MPI_MxmRunSearch: BTS=3, CAN=3, elapsedCANDSELECTION=0.018 seconds, MATCHED=3, elapsedMATCH=0.000 seconds.
[10/27/17 0:58:53:741 EDT] 0000013b TimerLog 1 com.ibm.mdm.mds.log.Adapter log IXN=MEM, USR=em, CAN=3, BTS=3, elapsed = 0.060 seconds.
[10/27/17 0:58:53:807 EDT] 0000013b TimerLog 1 com.ibm.mdm.mds.log.Adapter log MPI_MxmRunSearch: BTS=3, CAN=4, elapsedCANDSELECTION=0.017 seconds, MATCHED=4, elapsedMATCH=0.000 seconds.

[esix_splunk]

Are these single line events? Have you defined a props.conf for this source type?

If they are single line events, your props should look something like this :

[mysinglelinesourcetypeNAME]
SHOULD_LINEMERGE = false
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_PREFIX = ^\[

You can review what these options do via the Spec file : https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf

But for a quick overview;
1) Assuming these are single lines, we force the sourcetype to be single line
2) We know the timestamp is at the beginning of the line, so we tell Splunk to stop looking after 25 characters
3) We also know that the time stamp comes at the beginning of the line "^" and after the bracket "["..

If this is multiline, this props would change a bit...