What timerange did you search for? If the linebreaking fails this badly, I wouldn't be surprised if timestamping might also be broken, causing those events to show up on a different place on the timeline as where you may expect them based on when the error occurred. Alternatively, you could run a | metadata type=sources search over all time and see if the troubled source shows up in there.
But rather than trying to find this data in Splunk, I would use the information in the error message to track down the datasource, the forwarder that is sending this data and the relevant inputs, props and transforms that are getting applied. So you can check whether that config makes sense for that source file. The filename located in etc/ and ending in .cfg sounds like a config file. Not typically something you ingest into splunk; especially with BREAK_ONLY_BEFORE_DATE=true as I've never seen a config file that has dates before each line or so...
... View more