thank you for comment, we used LINE_BREAKER = ([\r\n ]+) format, also this method worked, event starting at \r\n as < 5 > 1 but when ı copy, it remove ... View more

This is the answer that I'm accepting. thank you ... View more

Echoing @rich7177 and @woodcock and adding a little more detail. (A) it's a compressed file. You have to uncompress it to read it. Sometimes less will silently decompress it for you. (B) Even if you do uncompress it, there's going to be binary data in it. Splunk's journal file has your raw events along with binary metadata about them. What you'll see is clumps of plain text event, surrounded by clumps of binary. That is just how it is, because that is how Splunk stores the data. ... View more