we dont have any UF on the windows machine, we are receiving the logs through UDP ... View more

The server count is huge and we are receiving the logs from the LB to our syslog server.  ... View more

Thank you @ITWhisperer @livehybrid  for looking into it.   I am receiving the logs from multiple windows hosts through the syslog server and we have the UF on the syslog server through the UF we are forwarding the data to the indexer. the actual breaking issue is-  when I am searching the logs  for the particular source by using the spl index="win"  sourcetype="*Snare*" | table host source   if i run the above query i should see only the hostname thats what we have configured our props and trnasforms but i am seeing the junk values in the host field actually its breaking in between somewhere in the event. ... View more