TRANSFORMS cannot change the sourcetype used for linebreaking because linebreaking occurs earlier in the parsing pipeline, before TRANSFORMS processing is applied.

This is because the input type is UDP, which is an unreliable protocol that does not guarantee delivery, order, or integrity of the data packets. UDP does not have any mechanism to resend or acknowledge the data packets, so if Splunk is restarted, any data that was in transit or in the buffer may be dropped and not indexed.

"The search head replicates the knowledge bundle periodically in the background or when initiating a search.
" "As part of the distributed search process, the search head replicates and distributes its knowledge objects to its search peers, or indexers. Knowledge objects include saved searches, event types, and other entities used in searching accorss indexes. The search head needs to distribute this material to its search peers so that they can properly execute queries on its behalf."

Set the stanza to have a server value equal to a comma-separated list of IP addresses and indexer ports for each of the indexers in the environment. This is explained in the Splunk documentation, which states:
To enable automatic load balancing, set the stanza to have a server value equal to a comma- separated list of IP addresses and indexer ports for each of the indexers in the environment. For example:
[tcpout] server=10.1.1.1:9997,10.1.1.2:9997,10.1.1.3:9997 The forwarder then distributes data across all of the indexers in the list.