Your issues is with event breaking not line breaking. (You shouldn't have to mess with the LINE_BREAKER setting.) I'm not sure if you assigned line numbers to your events of they are in the raw event data. If they are in the raw data, then it's possible that your it is confusing the date parser. So probably the best place to start is by setting up an explicit date format and telling splunk what junk to expect before the date. (The example given will match with or without the leading digit, so it should work either way.) I would try setting the following in your props.conf file: (Note that I'm using the sourcetype of your events instead of creating a host:: matching stanza because that's generally a better approach, at least from my experience.) [IntADOsNotConsolidated] TIME_PREFIX = ^(?:\d+ +)? # Date look like: 5/26/10 9:19:21.000 AM TIME_FORMAT = %m/%d/%y %I:%M:%S.%3N %P BREAK_ONLY_BEFORE_DATE = True If your event are always exactly one line, then you can remove the BREAK_ONLY_BEFORE_DATE entry, and replace it with the following: SHOULD_LINEMERGE = False As with all settings like this, these changes to your props.conf file will only effect newly indexed data after a splunk restart. ... View more