title: Howto break text line into multiple events
body: <p>I am new to Splunk and I'm trying to play a little bit with source type and the regex setting of it...Let's say I put following events into HEC:</p>
  
  <pre><code>curl -k https://utu:8088/services/collector/event/1.0 -H "Authorization: Splunk 21755979-ed43-4a1a-8962-e6e45ccf3ccf" -d '{"event": "splunk splunk splunk dog", "sourcetype": "hec_st"}'
  
  curl -k https://utu:8088/services/collector/event/1.0 -H "Authorization: Splunk 21755979-ed43-4a1a-8962-e6e45ccf3ccf" -d '{"event": "splunk splunk splunk cat", "sourcetype": "hec_st"}'
  </code></pre>
  
  <p><strong>hec_st</strong> is the source type with regex:</p>
  
  <p>(splunk)\s+</p>
  
  <p>with SHOULD_LINEMERGE=false</p>
  
  <p>Please why mentioned settings doesn't break string "splunk splunk splunk cat" into multiple events </p>
  
  <p>splunk<br>
  splunk<br>
  splunk<br>
  cat</p>
  
  <p>I'm able to find this string as one event always. Thanks a lot in advance</p>
  
  <p>T.</p>