Hi @bobryant You said that you put the inputs.conf and props.conf on the UF. is that correct? If yes it's explainable why the linebreaking doesnt work. your props.conf should be located on the first Splunk Enterprise Instance. This instance is responsible for the parsing and will do the linebreaking and timestamp extraction. This can be either a HF or a Indexer. I just noticed that you use the BREAK_ONLY_BEFORE parameters. I would exchange it with LINE_BREAKER and SHOULD_LINEMERGE=false . This way you get more performance out of Splunk and is also best practice doing that. The config could look like this: [appx:ipro] LINE_BREAKER = ([\r\n]+)\d{2}:\d{2}:\d{2}\.\d{3} MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = true SHOULD_LINEMERGE = false ... View more