I have a universal forwarder on a remote machine that forwards the splunk enterprise instance a log that may include lines that looks like this : ... 2015-06-15 12:00:01 | INFO ... 2015-06-15 12:00:02 | INFO | text (info) (name) marty (/name) (timestamp) 2015-06-15 12:00:02 (/timestamp) (/info) 2015-06-15 12:00:03 | INFO ... ... (** note that at 12:00:02 - that's supposed to be an xml doc ) Using the Splunk web interface (on the receiving side), I added in a sample file, and configured a new sourcetype on the receiving side to break on ^\d{4}-\d{2}-\d{2} (like 2015-06-15), and I could see that this worked based on the sample data that the web tool displayed. ( My goal is to make it so that Splunk doesn't think that the timestamp xml tag indicates a new Splunk event - I want the whole XML file displayed within the same event. ) I started up the forwarder by specifying the correct index and this new sourcetype. However, I noticed that it still broke up the line around the tag. Basically, Can/should line breaks be configured on the receiver or on the forwarder? Did I miss a step somewhere?? I understand that some of this can be configured through props.conf / transforms.conf, but I don't have the privileges to see these files yet. Thanks ! ... View more