I had the same problem on a UF, checking the sourcetype props I noticed that there were magic 6 on the agent. After deleting them, the collection works again. ... View more

When we ingest logfiles which contain Java we configure the linebreaker manually. This means that the whole java dump will be in one event instead of mixed up by the splunk auto parsing. In those cases our props.conf looks like this: [yoursourcetype] LINE_BREAKER = ([\r\n]+)\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2} SHOULD_LINEMERGE = false TRUNCATE = 100000 MAX_TIMESTAMP_LOOKAHEAD = 30 NO_BINARY_CHECK = true TIME_FORMAT=%F %T TIME_PREFIX=^ LINE_BREAKER should contain the timestamp after the ([\r\n]+) and you probably want to increase TRUNCATE to at least 100000 ... View more

This is resolved. rebuilding asset table for last 4hours [or less] data updates the status of fwders. ... View more