I'm just throwing some stuff out here:
Are you using a Universal Forwarder or a full Splunk heavy forwarder? If you're using full Splunk, the data gets "cooked" before it gets sent to the indexer. In this event, you need to either put the relevant props.conf configs on the forwarders, or set sendCookedData=false in your outputs.conf file and let the config take hold at the indexer. From a performance perspective, since you're (theoretically) using heavy forwarders it'd be best to do the parsing at the forwarder to relieve the indexer...
If you're already using a Universal Forwarder, the props.conf needs to be at the indexer where line breaking and other phases of data parsing happens. This is the typical modern deployment, since the Universal Forwarder is more light-weight and will have less impact on your endpoints.
See: http://docs.splunk.com/Documentation/Splunk/6.2.5/Forwarding/Typesofforwarders
... View more