I think it can happen when two events arrive "simultaneously" from the input. Or something. But it is very easy to fix.
In props.conf add this stanza (or add the statement to the existing stanza for the sourcetype)
SHOULD_LINEMERGE = false
This tells Splunk that every line is a separate event.
... View more