Hi All, I am trying to split a Splunk event into multiple events. I just want each line to be an event, and it was my understanding that this is Splunk's default line breaking attitude as long as each line has a time stamp. I am doing some TraceRoutes from various locations and having them output to a log file that I am sending to Splunk. I have been able to add a timestamp to each line and this made most of the lines be their own Splunk event, but the last 3 or 4 hops get bundled together into a single event. Here is an example of the lines that Splunk is putting into a single event: May 09 08:00:31 9.|-- fw.edge-sc9.elliemae.com 0.0% 30 78.4 78.5 78.2 81.7 0.6 May 09 08:00:31 10.|-- fw.edge-sc9.elliemae.com 0.0% 30 79.0 79.1 78.8 79.6 0.0 May 09 08:00:31 11.|-- be11147453.ea.elliemae.ne 0.0% 30 78.4 78.6 78.4 79.5 0.0 Note that each line for hops 1-8 have been split up into their own individual events. Please let me know if I just need to make a simple edit to the props.conf or something else. Thanks, Jordan ... View more