https://community.splunk.com/t5/Getting-Data-In/Event-breaking-is-sometimes-erratic/m-p/24640#M3915 <P>I've got an issue with some events we are receiving from multiple Active Directory hosts. Sometimes, the events break at random times. I've tried looking for a similar regex that might match where they are breaking, but I've found nothing.</P> <P>These hosts are all forwarding to a collector, which in turns forwards it to our 3 grouped indexers via a TCP port.</P> <P>98% of my events are breaking correctly by the timestamp, but every now and then I get an event like this:</P> <PRE><CODE>11/06/2012 07:42:02 AM LogName=Sec 11/06/2012 07:15:43 AM LogName=Secur </CODE></PRE> <P>Also, when I view the raw source for the events, those are the exact lines that are in the source as well.</P> <P>Not even entirely sure where to begin troubleshooting this. Could it be a props.conf issue? If yes, why is it only happening sometimes? Why only on certain hosts?</P> <P>Could it be TCP related?</P> <P>Any help on where to start looking would be appreciated.</P> Tue, 06 Nov 2012 12:59:12 GMT tiny3001 2012-11-06T12:59:12Z https://community.splunk.com/t5/Getting-Data-In/Event-breaking-is-sometimes-erratic/m-p/24640#M3915 <P>I've got an issue with some events we are receiving from multiple Active Directory hosts. Sometimes, the events break at random times. I've tried looking for a similar regex that might match where they are breaking, but I've found nothing.</P> <P>These hosts are all forwarding to a collector, which in turns forwards it to our 3 grouped indexers via a TCP port.</P> <P>98% of my events are breaking correctly by the timestamp, but every now and then I get an event like this:</P> <PRE><CODE>11/06/2012 07:42:02 AM LogName=Sec 11/06/2012 07:15:43 AM LogName=Secur </CODE></PRE> <P>Also, when I view the raw source for the events, those are the exact lines that are in the source as well.</P> <P>Not even entirely sure where to begin troubleshooting this. Could it be a props.conf issue? If yes, why is it only happening sometimes? Why only on certain hosts?</P> <P>Could it be TCP related?</P> <P>Any help on where to start looking would be appreciated.</P> Tue, 06 Nov 2012 12:59:12 GMT https://community.splunk.com/t5/Getting-Data-In/Event-breaking-is-sometimes-erratic/m-p/24640#M3915 tiny3001 2012-11-06T12:59:12Z https://community.splunk.com/t5/Getting-Data-In/Event-breaking-is-sometimes-erratic/m-p/24641#M3916 <P>Just going through my old questions and answering any unanswered ones.</P> <P>This issue was pretty much TCP related with faulty switching hardware to blame.</P> <P>Not sure why useACK didn't solve the problem though, but after fixing the hardware, the problem went away.</P> Wed, 17 Jun 2015 04:46:32 GMT https://community.splunk.com/t5/Getting-Data-In/Event-breaking-is-sometimes-erratic/m-p/24641#M3916 tiny3001 2015-06-17T04:46:32Z