always set these six parameters:

# CUSTOM
[my_custom_source_or_sourcetype]
TIME_PREFIX = \d{4}/\d{2} /\d{2} \d{2}:\d{2}:\d{2} \w+\s
TIME_FORMAT = %b %d %H:%M:%S %Y
MAX_TIMESTAMP_LOOKAHEAD = 20
SHOULD_LINEMERGE = False
LINE_BREAKER = ([\n\r]+)\d{4}/\d{2}/\d{2}\s\d{2}:\d{2}:\d{2}
TRUNCATE = 50000