We are currently in process of moving our logs from Kibana to Splunk.

So when raw data is sent to Splunk, there is an issue with events breaking due to the presence of "new line" characters in the event body. These line breaks are being misconstrued as the conclusion of one event and the commencement of another. For instance:

{

"PaymentID":1

}

is inaccurately interpreted as three events, each corresponding to a separate line.

Also, if you could please provide insights into the endpoint URL followed  Specifically, is it been sent from Pega to end point https://<internal_URL>/services/collector or https://<internal_URL>/services/collector/raw to display all types of message fields, what is the ideal folder to receive the raw data from Pega to Splunk folder.