I am reviewing my data ingestion health and I see the following error.
Breaking event because limit of 256 has been exceeded
Changing breaking behavior for event stream because MAX_EVENTS (256) was exceeded without a single event break. Will set BREAK_ONLY_BEFORE_DATE to False, and unset any MUST_NOT_BREAK_BEFORE or MUST_NOT_BREAK_AFTER rules. Typically this will amount to treating this data as single-line only.
Seems to be impacting about 20 of my hosts.
My props.conf on my indexer has the following customizations for this sourcetype otherwise it's thw default Splunk_TA_nix 8.2x configs that came with it.