Why are all events in one record and I am unable to extract fields?

[godman01]

We have CSV files dropping in the Windows folder and the CSV file contains users data but it was not parsing correctly. it was showing all the events in one record which I am not able to extract the fields?
my data looks like:

"CN=xxxx\\\, xxxx\,OU=Users\,OU=Users and Groups\,DC=xxxxxx\,DC=net","xxxx","xxxxx","[ NormalAccount ]"
"CN=xxxxx\\\, xxxxx\,OU=Users\,OU=Users and Groups\,DC=xxxx\,DC=net","xxxxx","xxxxxx","[ NormalAccount ]"
"CN=xxxxx\\\, xxxxx\,OU=Users\,OU=Users and Groups\,DC=xxxxxxx\,DC=net",xxxxxx","xxxxxx","[ NormalAccount ]"

my inputs.conf:

[batch://F:\FTPROOT\Splunk Inputs]
move_policy = sinkhole
sourcetype = idm:ftp:ad
index = test
disabled = 0
crcSalt = 

[batch://F:\FTPROOT\Splunk Inputs\IDM*.csv]
move_policy = sinkhole
sourcetype = idm:ftp:idm
index = test
disabled = 0
crcSalt = 

and my props.conf:

[source::F:\FTPROOT\Splunk Inputs*]
CHECK_METHOD = modtime
INDEXED_EXTRACTIONS = CSV
HEADER_FIELD_LINE_NUMBER=3
LINE_BREAKER = (uid=)(CN=)([\r\n]+)
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
INDEXED_EXTRACTIONS=csv

it should have different events individually. Any help will be appreciated?

[lguinn2]

I think the regular expression in your LINE_BREAKER is wrong.

If all your events are single-line (one event per line), then you can simply leave out the LINE_BREAKER; SHOULD_LINEMERGE=false is sufficient.

[godman01]

Thanks for the reply but all my events are single line events but it is not showing as one event .All my events are showing as one record ?

[godman01]

This data is alredy indexed so I want to make changes for the indexed data