Is there any chunk size applied while reading the data on the connections? chunk size like 2kb,4kb,8kb ? is there a way i can check this setting?
Also, Is there any logic at Splunk to make sure that the record has been read completely on the connection?
How is the data being read? It sounds like maybe a TCP or UDP connection. If so, stop everything and read http://www.georgestarcher.com/splunk-success-with-syslog/
If that is not the case then please describe your architecture and how the input is defined.