I am trying to fix the issue of my zeek logs not being broken into separate events. These logs are in json format and start with '{"ts":' and end with '}' (excluding single quotes). Given they are on separate lines, I would expect the code below to work. # In /opt/splunk/etc/system/local/props.conf # which I copied from the ../default/props.conf [default] ... LINE_BREAKER = ([\r\n]+) SHOULD_LINEMERGE = True ...  At this point I think my issue may be not knowing which stanza to place that in. I do have the SPLUNK_TA_ZEEK add-on, but that is in a specific app (not S&R). Looking under sourcetypes in the Web UI, there are zeek, zeek:conn, bro, bro_conn, etc sourcetypes, but my sourcetypes in my events are zeek_conn, etc. I went ahead and applied the above code to zeek, zeek:conn, bro, and bro_conn. TLDR: 1. What stanza do I edit? 2. Is the code snippet the correct settings? 3. Do I need to restart the cluster to apply these changes? ... View more