SUF sending to one port from many hosts, events overlap each other

[twinspop]

---

IGNORE this question/problem. Bad search skills led to bad conslusion.

---

About 30 Splunk Universal Forwarders sending to one indexer on a common port. The source of the data is a curl data pull from localhost. The HTML does not end in a line feed. (This seems to be an important point.)

Everything worked fine when one was running. However, when I fully deployed it, all hell broke loose. After much tweaking and investigation I see that Splunk is treating events that come in at roughly the same time from different hosts as the same event. This is no bueno.

Is this expected behavior? Any ideas on how to fix aside from assigning every forwarder to their own port? (Or fighting the long battle with development to add a line feed at the end of their HTML.)

[gkanapathy]

You have most likely misconfigured something. Many people have thousands of forwarders sending to a single indexer port. LINE_BREAKERs have nothing to do with this. I wonder if you are forwarding and receiving the data using the "splunktcp" protocol rather than syslog or plain tcp. I also wonder whether you have perhaps managed to set all of the universal forwarders to have the "host" field, although that should not matter.

[twinspop]

Overlapping events aren't the problem. My mistake. Got other problems with SEDCMD and event breaking, but I'll dig further before asking again. 😕

[twinspop]

Using splunktcp to receive. All SUFs are using tcpout stanzas in outputs.conf to send. All SUFs are default installs with regard to host definitions: $SPLUNKHOME/etc/system/local/inputs.conf has the unique hostname for each SUF install in a default stanza. The host attribute does not get set anywhere else.

[twinspop]

It seems like LINE_BREAKER might be some help. Testing it now, but it doesn't seem like I should need to delineate events from different hosts.