Can the "exception" log record that looks different from the regular log records and is spanned across a bunch of lines be indexed as one Splunk event? The whole log goes to the same sourcetype. To split the events I used in props.conf SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+) Although all the regular info-level log records have the timestamps, without this configuration some log records would be merged together into the same Splunk event probably because of the very high data density coming from this log. Here is the issue: Sometimes the log would have an "exception" record spanned across multiple lines with the lines number 2 and after not having the timestamp in them but they mostly would start with "\sat\s" pattern. It would look like this: <info-level record> <the start of the exception record> <tab>at ... <tab>at ... <tab>at ... <tab>at ... <info-level record> <info-level record> I added MUST_NOT_BREAK_BEFORE = \sat\s to the sourcetype stanza but it didn't help and the exception was broken into multiple Splunk events after the indexing. Is there a way to keep the exception as one Splunk event without affecting the regular info-level log records? Thank you. ... View more