You're correct about making changes in the props.conf on the indexer. But you will need to write a regular expression to successfully break those lines so Splunk will see them as a new event ^msg\,\w+ ... View more