A customer is having issues with truncated events greater than 64K.

The universal forwarder (UF) can cause truncation of events greater than 64K if it does not have the proper props.conf settings. The best practice magic 6 or great 8 props.conf settings are a set of attributes that control how the UF handles event breaking, line merging, timestamp extraction, and host extraction. These settings ensure that the UF preserves the integrity of the events and does not truncate or break them incorrectly. Therefore, the correct answer is B, configure the best practice magic 6 or great 8 props.conf settings. References :=

Configure event processing

The magic six or great eight props.conf settings