How do I break into multiple events just by space?

[Kitteh]

I want the one event in the picture to be broken into many events with the spaces in between. How do I do so with props.conf ?

Heres what i tried in my props.conf i tried "LINE_BREAKER = \s" and "LINE_BREAKER = [\s]"
[daemontest]
LINE_BREAKER = ([\s]+)
SHOULD_LINEMERGE = false

[Kitteh · Accepted solution]

This has been fixed by adding the parameter "BREAK_ONLY_BEFORE=\s"

[daemontest]
LINE_BREAKER = ([\s]+)
BREAK_ONLY_BEFORE =\s
SHOULD_LINEMERGE = false

Above is my parameters used just by splitting events with space.

[s2_splunk]

Are you configuring props.conf on the splunk instance that parses your event stream? That would be either your indexer, or a heavy forwarder you may have in your data ingest path.

[Kitteh]

I am using universal forwarder

[s2_splunk]

Then your parsing settings need to go on the indexer as the UF does not do any event parsing.

[jhigginsmq]

"LINE_BREAKER = ([\s]+)" with "SHOULD_LINEMERGE=false" should work, and it works for me after mocking up a similar example and using the preview feature of "Add Data".

Are you sure those settings are being applied, i.e. are you restarting/refreshing Splunk after editing props.conf?

[Kitteh]

Yes i've restart everytime i finished editing props.conf

[s2_splunk]

See above, these settings have no effect on the UF, they need to go on the indexer, which is where the event parsing happens.
All the forwarder sees are 64KB chunks of data read from a monitored file or received on a network input.