@jamie00171    Upon further testing, it seems that doing EVENT_BREAKER_ENABLE = true EVENT_BREAKER = "([\r\n]+)" Works, but only if accompanied by also doing force_local_processing = true   Are the event breaker flags ignored if there's no force local processing? ... View more

Hi,   I just tried adding EVENT_BREAKER_ENABLE = true, as well as also trying to add TRUNCATE = 0 in a different test, to no avial.   I'm basically trying to simply forward a logfile, unaltered, to a 3rd party tool, and am seeing what appears to be random line breaks in the file, sometimes even in the middle of a word.   So far my config is - outputs.conf [tcpout:fastlane] server = host.docker.internal:6996 sendCookedData = false   inputs.conf [monitor:///opt/splunkforwarder/etc/splunk.version] _TCP_ROUTING = default-autolb-group [monitor:///opt/splunkforwarder/var/log/splunk/metrics.log] _TCP_ROUTING = default-autolb-group [monitor:///opt/splunkforwarder/var/log/splunk/splunkd.log] _TCP_ROUTING = default-autolb-group [monitor:///var/log/test_file.log] disabled = false sourcetype = my_source_type _TCP_ROUTING = fastlane   And after you suggestion, added the following to props.conf [my_source_type] EVENT_BREAKER_ENABLE = true EVENT_BREAKER = ([\r\n]+) TRUNCATE = 0   So far, no success in having just the plain file being forwarded, as mentioned I'm having random line breaks throughout.   I am running this UF in a docker container on my local machine as I'm still testing this, but I doubt this is an issue here because if I'm using the same UF to forward the file to my local Splunk Enterprise node, I'm seeing the events exactly as they should be. ... View more

Years later, and I'm experiencing the same problem.   Were you able to fix this? ... View more