What is the configuration so that the following events show independently in the Splunk search?

[cesarbmx]

Could someone help me with the Splunk configuration so that the following events show independently in the Splunk search?

[my_sourcetype]
MAX_TIMESTAMP_LOOKAHEAD = 30
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = 
TIME_FORMAT = 

[somesoni2 · Accepted solution]

Give this a try

On your indexer/heavy forwarder (whichever comes first)

[yourSourceType]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(?=\{\"Event)
MAX_TIMESTAMP_LOOKAHEAD = 33
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7Q%:z
TIME_PREFIX = Timestamp\"\:\"

[richgalloway]

That LINE_BREAKER setting should have worked.  See if this one works any better.

LINE_BREAKER = ()\{"Event