See above response ... View more

Yes each event any time there is a new MXT time should be a separate event.  I recently changed the host settings to constant value from regex value. I think I need to fix the event breaks so it doesnt think the entire file is one event.  See the default for props.conf below:   [default] CHARSET = AUTO LINE_BREAKER_LOOKBEHIND = 100 TRUNCATE = 10000 DATETIME_CONFIG = \etc\datetime.xml ADD_EXTRA_TIME_FIELDS = True ANNOTATE_PUNCT = True HEADER_MODE = MATCH_LIMIT = 100000 DEPTH_LIMIT = 1000 MAX_DAYS_HENCE=2 MAX_DAYS_AGO=2000 MAX_DIFF_SECS_AGO=3600 MAX_DIFF_SECS_HENCE=604800 MAX_TIMESTAMP_LOOKAHEAD = 128 SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = BREAK_ONLY_BEFORE_DATE = True MAX_EVENTS = 256 MUST_BREAK_AFTER = MUST_NOT_BREAK_AFTER = MUST_NOT_BREAK_BEFORE = TRANSFORMS = SEGMENTATION = indexing SEGMENTATION-all = full SEGMENTATION-inner = inner SEGMENTATION-outer = outer SEGMENTATION-raw = none SEGMENTATION-standard = standard LEARN_SOURCETYPE = true LEARN_MODEL = true maxDist = 100 AUTO_KV_JSON = true detect_trailing_nulls = auto sourcetype = priority = ... View more