https://community.splunk.com/t5/Getting-Data-In/Is-the-regex-for-line-break-in-an-HF-Indexer-the-same-as-the/m-p/448907#M78026 <P>Yes to both questions, EVENT_BREAKER requires the EVENT_BREAKER_ENABLE flag, it helps the universal forwarder know when it can change to a new server listed in outputs.conf when the autoLBFrequency or autoLBVolume is reached, without this setting the forwarder will wait for the file that is monitored to stop updating for a period of time before making the switch to a different backend server in the outputs.conf list.</P> <P>The above setting makes no difference to the indexer/heavy forwarding tier which is parsing the data (except in a few edge cases on the UF).</P> <P>Therefore you want both, the LINE_BREAKER is still required if you have SHOULD_LINEMERGE=false and you want a multi-line event.</P> Tue, 29 Sep 2020 21:50:13 GMT gjanders 2020-09-29T21:50:13Z https://community.splunk.com/t5/Getting-Data-In/Is-the-regex-for-line-break-in-an-HF-Indexer-the-same-as-the/m-p/448906#M78025 <P>Hi All, </P> <P>Could you please help me understand if the regex for line break in HF/Indexer is the same as the Event_Breaker in a universal forwarder? Also, if Event_Breaker is defined, is it still recommended to give Line Break in heavy forwarder or Indexer?</P> Tue, 29 Sep 2020 21:46:20 GMT https://community.splunk.com/t5/Getting-Data-In/Is-the-regex-for-line-break-in-an-HF-Indexer-the-same-as-the/m-p/448906#M78025 akshatj2 2020-09-29T21:46:20Z https://community.splunk.com/t5/Getting-Data-In/Is-the-regex-for-line-break-in-an-HF-Indexer-the-same-as-the/m-p/448907#M78026 <P>Yes to both questions, EVENT_BREAKER requires the EVENT_BREAKER_ENABLE flag, it helps the universal forwarder know when it can change to a new server listed in outputs.conf when the autoLBFrequency or autoLBVolume is reached, without this setting the forwarder will wait for the file that is monitored to stop updating for a period of time before making the switch to a different backend server in the outputs.conf list.</P> <P>The above setting makes no difference to the indexer/heavy forwarding tier which is parsing the data (except in a few edge cases on the UF).</P> <P>Therefore you want both, the LINE_BREAKER is still required if you have SHOULD_LINEMERGE=false and you want a multi-line event.</P> Tue, 29 Sep 2020 21:50:13 GMT https://community.splunk.com/t5/Getting-Data-In/Is-the-regex-for-line-break-in-an-HF-Indexer-the-same-as-the/m-p/448907#M78026 gjanders 2020-09-29T21:50:13Z