You probably need to define a LINE_BREAKER in your props. With linemerge set to false, the default line breaker is crlf, which won't work for your events. For example, if the the details tag is the beginning of the new event, it might look something like below. The first capture group is what splunk will split the events on, the second group is just a lookahead to ensure it is just before the details tag. Also, if you're going to include the time prefix, might as well include it exactly as it is and the format if it's consistent... [ss_api2] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n\s]*)(?=\{\s*"details":) TIME_FORMAT=%Y-%m-%d %H:%M:%S.%4n TIME_PREFIX="timestamp":\s*" MAX_TIMESTAMP_LOOKAHEAD=25 ... View more

You will have to find someone's code or write your own for Arduino. But on a PI/Mac you can use Python and here is an existing HEC class for it. https://github.com/georgestarcher/Splunk-Class-httpevent ... View more