Howto break text line into multiple events - splunk

Question

I am new to Splunk and I'm trying to play a little bit with source type and the regex setting of it...Let's say I put following events into HEC:
curl -k https://utu:8088/services/collector/event/1.0 -H "Authorization: Splunk 21755979-ed43-4a1a-8962-e6e45ccf3ccf" -d '{"event": "splunk splunk splunk dog", "sourcetype": "hec_st"}'
curl -k https://utu:8088/services/collector/event/1.0 -H "Authorization: Splunk 21755979-ed43-4a1a-8962-e6e45ccf3ccf" -d '{"event": "splunk splunk splunk cat", "sourcetype": "hec_st"}'
hec_st is the source type with regex:
(splunk)\s+
with SHOULD_LINEMERGE=false
Please why mentioned settings doesn't break string "splunk splunk splunk cat" into multiple events
splunk
splunk
splunk
cat
I'm able to find this string as one event always. Thanks a lot in advance
T.

Answer 1

Firstly, the correct regex for your requirement is
([\s]+)
In case if you want to add it to the props.conf, you can use the following stanza,
[hec_st]
BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG =
LINE_BREAKER = (.)\s*
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Miscellaneous
description = Split events by space
pulldown_type = 1
Below are the guidelines to be followed while creating a regex for a source type to Define event boundaries for incoming data.
Specifies a regex that determines how the raw text stream is broken into initial events, before line merging takes place.
*This sets SHOULD_LINEMERGE = false and LINE_BREAKER to the user-provided regular expression.
Defaults to ([\r\n]+), meaning data is broken into an event for each line, delimited by any number of carriage return or newline characters.
The regex must contain a capturing group -- a pair of parentheses which defines an identified subcomponent of the match.
Wherever the regex matches, Splunk considers the start of the first capturing group to be the end of the previous event and considers the end of the first capturing group to be the start of the next event.
The contents of the first capturing group are discarded, and will not be present in any event. You are telling Splunk that this text comes between lines.
Input data:
My name is SV.
Output data:

Answer 2

Alright for anyone solving similar problem...I was successful in the end with following sourcetype stanza:
[hec_type]
BREAK_ONLY_BEFORE_DATE =
DATETIME_CONFIG =
LINE_BREAKER = ([\s+])
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
category = Miscellaneous
description = Split events by space
pulldown_type = 1
with this stanza sentence like "My name is Tomas" is being braked that word = event as I wanted. What really helps is to play with regexp in some online editor and then to put it into props.