Yes, you can use rex and multivalued fields to select new "raw" texts and expand them into new events. The fun is getting the regular expression right so you can use it like LINE_BREAKER. Here I am using a few things:
(?sm) -- s for "dot-all", so .*? matches newlines, and m for multiline, so ^ matches the beginning of a line instead of the beginning of an event
\d\d\.\d\d\.\d\d\s -- this would be the unique string, appearing in LINE_BREAKER after the () capturing group (space between events), that shows a new event is starting
.*? -- get the rest of the content for that event
((?=[\r\n]+\d\d\.\d\d\.\d\d\s)|(?!.)) -- this says collect content... until you find a spot that, after it, comes a newline followed by the above unique string. This means the event is ending. But, put an OR in there, because the last event won't have another event after it - so don't match anything.
Here is the full search string:
| rex field=_raw max_match=99 "(?sm)^(?<raw>\d\d\.\d\d\.\d\d\s.*?)((?=[\r\n]+\d\d\.\d\d\.\d\d\s)|(?!.))" | mvexpand raw | rename raw as _raw
Note: this only breaks up the raw text. Only up to 99 events will be extracted. Timestamps, field extractions, and event types will not be calculated from the "new" events.
... View more