Splunk splitting multi-line log events by date
Solution 1:
Tell Splunk to break events before a date that comes at the beginning of a line. And it would help to tell Splunk the expected format of timestamps:
LINE_BREAKER = ([\r\n]+)\d\d\d\d-\d\d-\d\d
TIME_PREFIX = ^
TIME_FORMAT = %Y-%m-%d %H:%M:S,%3N