You should only be using syslog outputs when sending to a non-Splunk server. If you're going to a Splunk indexer, use a configuration more like:
defaultGroup = output_fwd
server = 18.104.22.168:9997
useACK = true
syslog-udp will definitely lose data, and syslog-tcp will probably lose the last few messages before the TCP session closes (because it's impossible for Splunk to know what has actually been received), and then buffer it until a new TCP session is established.