https://community.splunk.com/t5/Getting-Data-In/Event-Breaks-at-line-257/m-p/144026#M29422 <P>Events always breaks at line 257. I have made changes to props.conf file under system/local in forwarder. But for some reason it is not working. Below are the props.conf settings</P> <P>[source]<BR /> MAX_EVENTS = 5000<BR /> SHOULD_LINEMERGE = true<BR /> BREAK_ONLY_BEFORE_DATE = True</P> Mon, 28 Sep 2020 16:28:46 GMT jpraman2000 2020-09-28T16:28:46Z https://community.splunk.com/t5/Getting-Data-In/Event-Breaks-at-line-257/m-p/144026#M29422 <P>Events always breaks at line 257. I have made changes to props.conf file under system/local in forwarder. But for some reason it is not working. Below are the props.conf settings</P> <P>[source]<BR /> MAX_EVENTS = 5000<BR /> SHOULD_LINEMERGE = true<BR /> BREAK_ONLY_BEFORE_DATE = True</P> Mon, 28 Sep 2020 16:28:46 GMT https://community.splunk.com/t5/Getting-Data-In/Event-Breaks-at-line-257/m-p/144026#M29422 jpraman2000 2020-09-28T16:28:46Z https://community.splunk.com/t5/Getting-Data-In/Event-Breaks-at-line-257/m-p/144027#M29423 <P>Hello,<BR /> It is not a heavy forwarder, you need t place the props.conf file in indexer. If data already indexed. Please delete them and re-index to fid the desired result.</P> <P>Thanks</P> Sun, 27 Apr 2014 07:01:49 GMT https://community.splunk.com/t5/Getting-Data-In/Event-Breaks-at-line-257/m-p/144027#M29423 linu1988 2014-04-27T07:01:49Z