Two things: First, the BREAK_ONLY_BEFORE directive is used in the line merging process - that is, given a number of lines, it tells (optionally in conjunction with other parameters) how Splunk should merge these lines into one event. So, the definition of what a line IS happens earlier, using the LINE_BREAKER directive. Your log looks a bit odd to me in that the events aren't broken up into individual lines already. Before starting to mess with LINE_BREAKER you might want to investigate if the log itself can't be changed to actually separate events properly into individual lines. Second, the [ and ] characters are special characters in regular expressions, so whatever regex you end up with will need to escape those. ... View more

I think you would be better defining the timestamp and telling splunk to break only before a time stamp. [client_log] SHOULD_LINEMERGE = true BREAK_ONLY_BEFORE_DATE = true TIME_PREFIX = \[ TIME_FORMAT = %H:%M:%S.%3N ... View more