Give this a try:
LINE_BREAKER = \-+([\n\r])Timestamp:\s+
If it doesn't help, you may want to check splunkd.log for errors related to this line breaking failing. You could also check btool to ensure that the configuration is being read, run 'splunk cmd btool props list --debug > ~/output from $SPLUNK_HOME/bin/. I presume that all events carry the sourcetype you've specified in the 'sourcetype' metadata field?
... View more