"timebeforeclose" Will cause Splunk to wait a specified amount of time after Splunk has reach an EOF condition. The default of 3 seconds can be too low on systems buffering their writes or very heavily loaded systems. That will cause Splunk to truncate events.
Another option that will help is "multilineeventextrawaittime = true". I'd recommend using this setting in combination with "timebefore_close".
Between these two settings, Splunk will wait longer for writes to happen when they're "mid event" and that will reduce event truncation significantly.
Some draw-backs of "timebeforeclose" are that Splunk will use extra file descriptors as it is keeping more files open longer.
Lastly, don't use "followTail" unless instructed to do so by support. It doesn't sound like it will help in your situation and will likely cause more issues than it solves.