Need to break the events before certain word.

[isha_rastogi]

I've log file something like below,

DA FILE: /archive/attr/ABC/XYZ/20170911/file.log-new*** Files traversed: 128 - and  file format matches ***
DA FILE: /archive/attr/ABC/XYZ/20170911/file.log-newCreating the follwing directory for today's date: /mktaccess/archive/attr/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/attr/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/hello-US/abc/xyz/20170911Creating the follwing directory for today's date: /mktaccess/archive/hello-US/abc/xyz/20170911

Log format is like a paragraph.. It's the stdout and stderr output of a script
I need to break the line after ******* and before Creating. I'm writing something like below
[test]
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=Creating
MUST_BREAK_AFTER=^\d{8}
TIME_FORMAT=%Y%m%d
TIME_PREFIX=(OR\w*\/)+

[cpetterborg]

If this works for you, I can change this comment to an answer and then you can accept it so that it can be marked as solved. Thanks!

[cpetterborg]

Your question appears to have had formatting changes that are making answering it difficult. Please highlight your example text and use the 101010 formatting option the help make the text come through properly.

[isha_rastogi]

@cpetterborg I've made necessary changes, please take a look

[cpetterborg]

With the data you have, you can't break up the line into different events without loosing some data, and even that has some issues.

If you don't mind doing it at search time, instead of at index time, it can be done pretty easily. You can do something like this:

... | rex mode=sed "s/(\*\*|Creating)/|\\1/g"
| rex max_match=0 "\|(?P<part>[^\|]+)"
| mvexpand part
| table _time, part

You may add any additional fields to the table, but it worked on the example data that you provided to break the event up into multiple events for further processing.

Splunk doesn't like to split up lines like that. If the data coming in had a character (like I used the |), then you could break it up at index time, and only loose the |.