https://community.splunk.com/t5/Getting-Data-In/Reading-large-Files-using-Splunk-UF/m-p/497088#M84752 <P>Can you show us your <CODE>props.conf</CODE> and <CODE>inputs.conf</CODE> stanza? Have you tried to set <CODE>EVENT_BREAKER</CODE> as well as <CODE>EVENT_BREAKER_ENABLE</CODE> in the props.conf for that sourcetype? I don't know of any performance tests done using those settings, but I'd try setting</P> <PRE><CODE>EVENT_BREAKER_ENABLE = true EVENT_BREAKER = \r\n </CODE></PRE> <P>Skalli</P> Wed, 18 Mar 2020 09:54:50 GMT skalliger 2020-03-18T09:54:50Z https://community.splunk.com/t5/Getting-Data-In/Reading-large-Files-using-Splunk-UF/m-p/497087#M84751 <P>Hi,</P> <P>I am currently trying to read logs file of size 10Gb. I have changed thruput to 0 but still takes about 30 min-1 hr for Splunk to finish reading the file. Is there a way to increase the reading speed further for splunk UF.</P> Tue, 17 Mar 2020 22:05:26 GMT https://community.splunk.com/t5/Getting-Data-In/Reading-large-Files-using-Splunk-UF/m-p/497087#M84751 akshatj2 2020-03-17T22:05:26Z https://community.splunk.com/t5/Getting-Data-In/Reading-large-Files-using-Splunk-UF/m-p/497088#M84752 <P>Can you show us your <CODE>props.conf</CODE> and <CODE>inputs.conf</CODE> stanza? Have you tried to set <CODE>EVENT_BREAKER</CODE> as well as <CODE>EVENT_BREAKER_ENABLE</CODE> in the props.conf for that sourcetype? I don't know of any performance tests done using those settings, but I'd try setting</P> <PRE><CODE>EVENT_BREAKER_ENABLE = true EVENT_BREAKER = \r\n </CODE></PRE> <P>Skalli</P> Wed, 18 Mar 2020 09:54:50 GMT https://community.splunk.com/t5/Getting-Data-In/Reading-large-Files-using-Splunk-UF/m-p/497088#M84752 skalliger 2020-03-18T09:54:50Z