MAX_EVENTS refers to the maximum number of lines in a multi-line event, not the number of lines in the log file. TRUNCATE refers to at what point Splunk should cut off individual lines. Many times, problems like this is related to improper detection of timestamps (which in turn affects the breaking of the log file into individual events). The default behaviour is to break the file when a timestamp is detected. Consider using the following settings in props.conf SHOULD_LINEMERGE = false LINE_BREAKER = some regex for when to break between events TIME_FORMAT = strptime formatting TIME_PREFIX = string that precedes the timestamp MAX_TIMESTAMP_LOOKAHEAD = number, indicating how far into an event Splunk will look for the timestamp. Read more in the docs for props.conf and timestamp recognition in general http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf http://docs.splunk.com/Documentation/Splunk/latest/Data/HowSplunkextractstimestamps Posting some sample events may lead to a more qualified answer. Hope this helps, K ... View more