Which two stanzas? ... View more

  This was one of the event which only has year and rest of the data is not there ,,,other part of data is in separate event . Every time its happing with 7-8 events from a file of 800 events. ... View more

timeStamp,label,responseCode,Hostname 2020/10/29 19:14:12,3 /xxxxxx,302,xxxxxxxx 2020/10/29 19:14:15,Forgot your ID or password?,200,xxxxxxxx 2020/10/29 19:14:19,Signup for free,200,xxxxxxxxxx 2020/10/29 19:14:23,3 /xxxxxxxxxx,302,xxxxxxxxx ... View more

Below is the inputs: [monitor://path] index = xyz sourcetype = csv disabled = false We also tried to add props at the indexing tier but results were same. ... View more

1. events are getting truncated and not dropped. Events are small  timeStamp,label,responseCode,Hostname file size is 80 kb 2. Using a Universal forwarder   3.  I have used forwarder level props.conf  [csv] INDEXED_EXTRACTIONS=csv ... View more