maxEventSize = <positive integer>[KB|MB|GB] * The maximum size of a single HEC (HTTP Event Collector) event. https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf  ... View more

One of the engineers at Splunk was able to help me out. This resolved the issue for me. [http] disabled = 0 maxEventSize = 15728640 Here is the email I got that explains it: Hello Mike, To address the issue referenced below, a new global setting called maxEventSize under [http] stanza in inputs.conf has been introduced to allow customers to configure the expected maximum size of HEC event as part of these releases 7.0.5, 7.0.3.7, 7.1.3, and later. A workaround for this issue is to have 6.x based HWFs parse the HEC events before forwarding to indexers. Please let me know if you have any additional question. ... View more

The root cause of this is that HEC is rejecting specific log entries because they are too large. I have opened an additional question to figure out how to fix that. https://answers.splunk.com/answers/753896/is-it-possible-to-change-the-maxvaluesize-for-hec.html#question-753896 ... View more