After validating the logs and with the help of your solution, I decided to use these settings. SHOULD_LINEMERGE = false TRUNCATE = 0 (because some events are already broken and don't contain a linebreaking rule). Thank you for the advice.

Im really not sure what this is doing. I incorporated it into my code and was not what I was expecting. I have also shifted my efforts to using a span=15m for my timechart command due to some other calculations that are on the dashboard I am working on that using a span/bucket smaller than 15 minutes does not represent the data in the way the user(s) are expecting. So, my next question (I can start a new thread if needed) is that using a span=15m for an hour sample of four 15 min buckets. But, the buckets are at the 15 min mark of each hour and do not start from when the query is run. i.e. Buckets = 0-15, 15-30, 30-45, 45-00.  Is there an option on timechart to force it to start at the current minute ? I found in the documentation a reference to <snap-to-time> but dont understand how to use it.

@ITWhisperer  I am using same in my query but not getting correct starttime and end time query: index="abc"sourcetype =600000304_gg_abs_ipc2 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" | rex "TRIM\.CNX(CTR)?\.(?<TRIM_ID>\w+)" | transaction TRIM_ID startswith="Reading Control-File /absin/TRIM.CNXCTR." endswith="Completed Settlement file processing, TRIM.CNX." |eval StartTime=min(_time)|eval EndTime=StartTime+duration|eval duration_min=floor(duration/60) |rename duration_min as TRIM.CNX_Duration| table StartTime EndTime TRIM.CNX_Duration| sort +StartTime +EndTime| fieldformat ProcessingStartTime = strftime(ProcessingStartTime, "%F %T.%3N")| fieldformat ProcessingEndTime = strftime(ProcessingEndTime, "%F %T.%3N")  

I see the trim function didn't remove the first quotation mark since it isn't at the beginning of the event (because of the timestamp).  Here's another regex to try.  It attempts to replace the event with the text after 'rawJson="' up to the last '"'. | rex mode=sed "s/rawJson=\\\"(.*)\\\"$/\1/"