I have set a search that looks through all logs in my nifi-app.log file where the header "Standard FlowFile Attributes" is seen. The actual nifi-app.log file displays all lines corresponding to instances where the "Standard FlowFile Attributes" header appears (approximately 16 lines). In Splunk, I notice in most cases, it also returns events where for each event, it is possible to see all 16 of these lines. However, occasionally (e.g. approximately 5 out of every 100 events returned), I will see that some events only contain three lines of the 16 lines that should be visible. There is no way to see additional lines because there are no more additional lines to show in this uncommon cases. When I go back to verify there wasn't an issue in the nifi-app.log file, I find there wasn't one and that for the same event identified by date and timestamp in Splunk that only shows a portion of the total lines, the log it's meant to show from the nifi-app.log file shows all 16 lines. I was thinking this could possibly have something to do with event breaking and potentially configuring the props.conf file in my /local directory, but I don't believe this is the case because if it was, then there wouldn't be any of the events that fully display all 16 lines. It seems as if something is occurring where for the exact same type of events that are displayed in Splunk, in some cases, not all of the line content is shown and does not appear at all in these event logs. Could someone let me know why this occurs? Also, if any suggestions as to how to resolve this from occurring exist, I would greatly appreciate them as well. Thanks in advance! ... View more