Reference:https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Data/Configureeventlinebreaking Line breaking, which uses the LINE_BREAKER setting to split the incoming stream of data into separate lines. By default, the LINE_BREAKER value is any sequence of newlines and carriage returns. In regular expression format, this is represented as the following string: ([\r\n]+). You don't normally need to adjust this setting, but in cases where it's necessary, you must configure it in the props.conf configuration file on the forwarder thatsends the data to Splunk Cloud Platform or a Splunk Enterprise indexer.
The LINE_BREAKER setting expects a value in regular expression format.

* IgnoreOlderThan: This setting filters files for indexing based on their age. It does not prevent indexing of old data already in the file.
* allowList: This setting allows specifying patterns to include files for monitoring, but it does not control indexing of pre-existing data.
* monitor: This is the default method for monitoring files but does not address indexing pre-existing data.
* followTail: This attribute, when set in inputs.conf, ensures that Splunk starts reading a file from the end (tail) and does not index existing old data. It is ideal for scenarios with large files where only new updates are relevant.
References:
* Splunk Docs: Monitor text files
* Splunk Docs: Configure followTail in inputs.conf

https://docs.splunk.com/Documentation/Splunk/8.1.1/DistSearch/Forwardsearchheaddata Per the provided Splunk reference URL by @hwangho, scroll to section Forward search head data, subsection titled, 2. Configure the search head as a forwarder. "Create an outputs.conf file on the search head that configures the search head for load-balanced forwarding across the set of search peers (indexers)." Reference: https://community.splunk.com/t5/Getting-Data-In/How-to-configure-search-head-to- forwardinternal-data-to-the/td-p/111658

http://www.splunk.com/view/SP-CAAAGPR

https://docs.splunk.com/Documentation/Splunk/latest/Deploy/Datapipeline "The data pipeline segments in depth. INPUT - In the input segment, Splunk software consumes data. It acquires the raw data stream from its source, breaks it into 64K blocks, and annotates each block with some metadata keys. The keys can also include values that are used internally, such as the character encoding of the data stream, and values that control later processing of the data, such as the index into which the events should be stored. PARSING Annotating individual events with metadata copied from the source-wide keys. Transforming event data and metadata according to regex transform rules."