Please help Im new to regex and Im having trouble getting splunk to recognise the end of an event. Below is an example of how splunk is seeing the log files. The domain reference is part of the event before and i need the event to break at the DTG, not at the domain=blah before it.
domain=my.domain.it.com [17/Jul/2013:11:17:03 -0500] remote_host=nn.nnn.nnn.nnn ajax=- http_method=GET url=/pr XXXXXXXXX domain=your.domain.uk.com [17/Jul/2013:11:17:03 -0500] remote_host=nn.nnn.nnn.nnn ajax=- http_method=GET url=/pr XXXXXXXXX domain=my.funkydomain.uk.com [17/Jul/2013:11:17:03 -0500] remote_host=nn.nnn.nnn.nnn ajax=- http_method=GET url=/pr XXXXXXXXX domain=his.funkydomain.uk.com [17/Jul/2013:11:17:03 -0500] remote_host=nn.nnn.nnn.nnn ajax=- http_method=GET url=/pr XXXXXXXXX