We also have EqualLogic, are capturing the syslogs, and are annoyed when some events are split in to two. Using WireShark, I captured the syslogs and looks like the "offending" characters are "\x0d\x0a", which in the ASCII world are (Carriage return)(Line feed), respectfully. I'm new to Splunk and haven't had the training. If you can develop a solution be for I, I'd love to see it. ... View more