The documentation that you refer to has them both in the same stanza, in steps 3 and 4: Break and reassemble the data stream into events This method oftentimes simplifies the configuration process, as it gives you access to several settings that you can use to define line-merging rules. You must perform these steps on the heavy forwarder that you have designated to send data to your Splunk Cloud Platform instance. On the forwarder that is to send data to your Splunk Cloud Platform instance, use a text editor to open $SPLUNK_HOME/etc/system/local/props.conf for editing. In this file, specify a stanza in the props.conf configuration file that represents the stream of data you want to break and reassemble into events. In that stanza, configure the LINE_BREAKER setting with a regular expression that breaks the data stream into multiple lines. Add the SHOULD_LINEMERGE setting to the stanza, and set its value to true. Configure additional line-merging settings, such as BREAK_ONLY_BEFORE and others, to specify how the forwarder is to reassemble the lines into events. For more information on the line-merging settings, see Attributes that apply only when the SHOULD_LINEMERGE setting is true later in this topic. If your data conforms well to the default LINE_BREAKER value, which is any number of newlines and carriage returns, you don't need to change the LINE_BREAKER setting. Instead, set SHOULD_LINEMERGE=true and use the line-merging settings to reassemble the data.
... View more
