Need some help with event breaks

Hi all, I was hoping someone might be able to point me in the right direction for where to set this and how exactly to set it: I'm consuming some logs from SCCM (log sample below for reference) and they have a distinct pattern for events and event breaks. I know that the regex that i would come up with is supposed to go into either props.conf or transforms.conf but I don't know which. Sample events: `` `` `` `` As you can see from the sample above: Each event "header" starts with `` Each event "detail" starts with `<` and ends with `>` and is always preceded by the "header" before it. So effectively, it's `` My thought was to do a single event as `` and from there I could do field extractions for the "header text" and each part of the detail (where something=somethingelse). Assuming I do the field extractions within splunk instead of props.conf/transforms.conf (best practice now), how should I do the event break? Should I do something where "the end of every event is `">` " and set that as the props.conf `LINE_BREAKER` ? Are there any other considerations that I should be aware of, such as `SHOULD_LINEMERGE` or other things? Many thanks