You'll need to configure props.conf at the parsing layer (probably on your indexer) appropriately. That includes creating a new stanza for your sourcetype and telling Splunk how to deal with the format. http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf http://pubs.opengroup.org/onlinepubs/009695399/functions/strptime.html Something like this should work. Tell splunk to merge multiple lines into one event and where to break events. Then tell it where the timestamp is and what the format looks like. [your sourcetype] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE = <LOG> TIME_PREFIX = <DATE> TIME_FORMAT = %d%m%Y</DATE>%n<TIME>%H%M%S ... View more