I just add a new BlueCoat box as my new proxies.
After configured it just like my actual one, the logs arrived on the Heavy Forwarder ethernet interface, but they arrived fragmented on multiple small frames, With approx 1600 Users logged on this new proxy, I'm quite sure that the logs received are not complete.
1. can you share your inputs and props config using btool ? (ec : command to list props is : ./splunk cmd btool props list )
2.please do check internal log for fragmentation to validate that splunk is splitting events and not something else in the chain (a syslog server could split for example) : search for index=_internal sourcetype=splunkd truncating.