Go to this folder and check: /opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db. May be due to some Permission Issues. ... View more

If the content of log file is overwritten every time then you don't need to BREAK the events. Just set SHOULD_LINEMERGE to true and check. ... View more