Why is the universal forwarder not forwarding some lines in my logs?

[raiszani]

I'd set up the universal forwarder to send my logs to another server and it's working, but it's losing part of some lines in the process, as shown in the image attached. Does anyone knows how to solve that?

[deepthi5]

Hello ,

It looks like the parsing rules for the events to break were not defined properly please use the below stanza in your props.conf file and save and restart you splunk service
Replace sourcetypename with the sourcetype name of your log

[sourcetypename]
TIME_FORMAT = %Y.%m.%d.%H:%M:%S:%3N
MAX_TIMESTAMP_LOOKAHEAD = 23
NO_BINARY_CHECK = 1
pulldown_type = 1
SHOULD_LINEMERGE=true
BREAK_ONLY_BEFORE =^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}\,\d{3}

[raiszani]

Thanks for your answer. I did it a try and still not working.
Actually i'm using 2 sourcetypes: CSV and Catalina

[jkat54]

Looks like a bad line_breaker regex. Can you post your props.conf from the forwarder & indexers? Or if you're in a single instance environment, just the props.conf?

[raiszani]

Sure. Here is the link:

http://pastebin.com/qkr7UBnW