Why are events with timestamps being grouped together in one event?

[athorat]

We see some events with timestamps clubbed together in one event.
Changing the props.conf did not help to resolve the issue.

Sample:

12/8/15 
12:07:53.000 AM 

[4/20/15 0:07:53:255 MST] 00000017 SystemOut     O File modification detected
[4/20/15 0:07:53:255 MST] 00000017 SystemOut     O Reading data from file '/opt/Jenkins/was_deploy/jvmDateCalculator.properties'
[4/20/15 0:07:53:255 MST] 00000017 SystemOut     O Date format is 'yyyy-MM-dd'
[4/20/15 0:07:53:255 MST] 00000017 SystemOut     O Base date from file is 2015-04-21
[4/20/15 0:07:53:255 MST] 00000017 SystemOut     O Base date was incremented on 0 days with result: 2015-04-21

[woodcock]

You need to set SHOULD_LINEMERGE to false.

[renjith_nair]

@athorat, where is the clubbing and what's in your props.conf. One of the following props should help you - depends on your event

# Use the following attributes to specify how multiline events are handled.

SHOULD_LINEMERGE = [true|false]
* When set to true, Splunk combines several lines of data into a single
  multiline event, based on the following configuration attributes.
* Defaults to true.

# When SHOULD_LINEMERGE is set to true, use the following attributes to
# define how Splunk builds multiline events.

BREAK_ONLY_BEFORE_DATE = [true|false]
* When set to true, Splunk creates a new event only if it encounters a new
  line with a date.
  * Note, when using DATETIME_CONFIG = CURRENT or NONE, this setting is not
    meaningful, as timestamps are not identified.
* Defaults to true.

BREAK_ONLY_BEFORE = <regular expression>
* When set, Splunk creates a new event only if it encounters a new line that
  matches the regular expression.
* Defaults to empty.

MUST_BREAK_AFTER = <regular expression>
* When set and the regular expression matches the current line, Splunk
  creates a new event for the next input line.
* Splunk may still break before the current line if another rule matches.
* Defaults to empty.