Guide

Onboarding data in Splunk: props.conf for line breaking and timestamps

Q: Should SHOULD_LINEMERGE be true or false?

Set it to false and define event boundaries with LINE_BREAKER. It is faster and more predictable than line merging.

Updated November 3, 2026 · Ayrix Labs

Short answer: For each sourcetype, set LINE_BREAKER, SHOULD_LINEMERGE = false, TIME_PREFIX, TIME_FORMAT, MAX_TIMESTAMP_LOOKAHEAD and TRUNCATE in props.conf on the first full Splunk instance the data passes through (indexer or heavy forwarder), plus EVENT_BREAKER on universal forwarders.

A complete stanza

[acme:app:log]
LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2}\s
SHOULD_LINEMERGE = false
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:%S.%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
TZ = UTC
TRUNCATE = 10000
# on universal forwarders, so load balancing switches only between events
EVENT_BREAKER_ENABLE = true
EVENT_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2}\s

Where each setting goes

Setting	Applies at	Put it on
LINE_BREAKER, SHOULD_LINEMERGE, TRUNCATE, TIME_, TZ, TRANSFORMS-	Parsing (index time)	Indexers, or the heavy forwarder if data passes through one first
EVENT_BREAKER_ENABLE, EVENT_BREAKER	Universal forwarder output	Universal forwarders
INDEXED_EXTRACTIONS (CSV, JSON, W3C...)	Structured parsing	The forwarder that reads the file
KV_MODE, EXTRACT-, REPORT-, FIELDALIAS-, EVAL-, LOOKUP-*	Search time	Search heads

Index-time settings apply only to data indexed after the change. Data already indexed keeps its old event boundaries and timestamps.

Find sourcetypes with parsing problems

index=_internal sourcetype=splunkd earliest=-24h
    (component=DateParserVerbose OR component=LineBreakingProcessor OR component=AggregatorMiningProcessor)
| stats count by component, data_sourcetype
| sort - count

DateParserVerbose means timestamps could not be read or were out of range; LineBreakingProcessor usually means events hit TRUNCATE; AggregatorMiningProcessor means line merging hit its limits, which SHOULD_LINEMERGE = false with a correct LINE_BREAKER avoids.

Check what is in effect

$SPLUNK_HOME/bin/splunk btool props list acme:app:log --debug

--debug shows which file each setting comes from, so you can see when an app's default overrides what you expected.

Test before production

Use Settings, Add Data, Upload with a sample file on a test instance, pick or edit the sourcetype, and check the preview's event breaks and timestamps before copying the stanza to production.

How Drew helps

Ask Drew "which sourcetypes have timestamp or line-breaking errors?" Drew runs the _internal search above on your deployment and lists the sourcetypes and error counts.

Answers from your own Splunk. Ask in plain English in Slack or the web app. Drew runs the SPL searches through your Splunk MCP Server and answers with text, tables or charts.
Says whether each answer was checked. Every answer that states figures is marked Verified (a search this turn returned the data), Likely (figures from an earlier search, with when) or Not checked. The label is decided by code from what actually ran, not by the model.

Drew is taking a small group of MSPs, Splunk teams and consultants into early access. Request access or email hello@rundrew.com.

Questions

Where does props.conf go for line breaking?

On the first full Splunk instance that parses the data: the indexers, or a heavy forwarder in front of them. Universal forwarders only need EVENT_BREAKER settings.

Should SHOULD_LINEMERGE be true or false?

Set it to false and define event boundaries with LINE_BREAKER. It is faster and more predictable than line merging.