In my case, Splunk Split one event into multiple events because of the following parameter in props.conf
LINE_BREAKER = (\r\n)
So i removed the "\r\n" combination in the sql column by executing the below query in SQL table
/** Remove Carriage return and Line Feed **/
UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(13), ' ' )
UPDATE ProblemTable
SET ProblemColumn = REPLACE(ProblemColumn, char(10), ' ' )
After corrected the SQL server column values, Splunk not created any multi level events and data loaded correctly.
... View more