some json log lines are merged into one block

[ajitdev381]

Our application prints logs in json format . example 

{"ts":"05 30 2023 10:30:00.013","th":"logging-metrics-publisher","level":"INFO ","logger":"LoggingMeterRegistry","msg":"jvm.threads.states{state=timed-waiting} value=40 threads" }
{"ts":"05 30 2023 10:30:00.012","th":"logging-metrics-publisher","level":"INFO ","logger":"LoggingMeterRegistry","msg":"jvm.threads.states{state=waiting} value=222 threads" }

Some logs are displayed in json format and some are not . json format logs are generated by same code .  but i am not sure why some logs are shown in same block like this.

we haven't put anything in props file

[isoutamo]

Hi

Usually it's good to do needed onboard like define what those files contains and also define now sourcetype for those. In most cases this needs both inputs.conf on source system and/or props.conf (+transforms.conf) on 1st full Splunk Enterprise instance to get those correctly imported into splunk.

How you are getting those events? Read those from log file via UF or getting those via HEC or something else?

r. Ismo