I want to use Batch input because Splunk will delete source files for me and I would not need to handle their purging. If my system is generating files as small as 1K files, should I use BATCH INPUT. I do not know what this boundary is for small v/s large archives from Splunk's point of view. ... View more

Hi Dilip. A couple of things I can think of: Your MAX_TIMESTAMP_LOOKAHEAD value of 27. Unlikely to be the cause of the issue, but your timestamps are far in excess of 27 characters in (I count 165), and this is unnecessary as you have consistently defined TIME_PREFIX. Any reason why you're not using KV_MODE = xml? Wht regex are you using for your disc_xml_header (unlikely to be related, but I like to cover off all bases) Have you tried replacing the your prop/transforms with what I posted? I find starting from scratch and building up from there often helps ... View more