Robert Fujara

I am experiencing the same issue. Even using a bigger machine type doesn't solve the problem. Any idea how to troubleshoot this?

From my point of view, line breaking/merging should be done on Splunk side. I created [prototype](https://github.com/hovu96/fluent-plugin-splunk-hec/commit/02fff6814b19f720ce70126c483d5473d98ea17c) and there is also this [branch](https://github.com/splunk/fluent-plugin-splunk-hec/commit/fca9f4c368a523fedabab170af157bd8b0903cbd#diff-474f530618c2fd088becd7dc20da7ccd), both adding an option for using the RAW...