If you have multiple events using the same line, then you should use the props that should look something like this: props.conf: [sourcetype] TIME_PREFIX = depends on the timestamp you want TIME_FORMAT = not sure what time you want to use - initial or final MAX_TIMESTAMP_LOOKAHEAD = ? SHOULD_LINEMERGE = true LINE_BREAKER = |\d{2}(\s)\d+ TRUNCATE = 50000 REPORT-extraction = your_extraction transfoms.conf: [your_extraction] DELIMS = "|" FIELDS = emp, user, session_id, datei_mday, datei_month, datei_year, datei_hour, datei_minute, datef_mday, datef_month, datef_year, datef_hour, datef_minute Hope it works! ... View more