<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic xml rest import not spltting into envents in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/xml-rest-import-not-spltting-into-envents/m-p/409065#M100254</link>
    <description>&lt;P&gt;I have a dashboard xml export from another app. the xml does not appear to be forrmatted as true xml using &amp;lt;&amp;gt; for some sections. in the sample code below I need the break on each section starting with chartdashlet (ie each section is an event). I have added the following line in the props.conf &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;BREAK_ONLY_BEFORE = (?m)^(&amp;lt;chartdashlet)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;the regex is supposed to cause the break before each chartdashlet entry&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Sourcetype props.conf entry:
[dynatrace_cbosys_xml]
SHOULD_LINEMERGE = true
#LINE_BREAKER = }(,){
BREAK_ONLY_BEFORE = (?m)^(&amp;lt;chartdashlet)
SEDCMD-remove_header = s/\{\"meta.+?data\":\[//g
SEDCMD-remove_footer = s/\]\}//g
TRUNCATE = 0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The xml input still comes in as one event. See sample xml event below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;?xml version="1.0" encoding="utf-8"?&amp;gt;&amp;lt;dashboardreport name="CBOSYS_Application_Status" version="7.0.7.1013" reportdate="2018-08-15T10:55:06.637-04:00" description=""&amp;gt;  &amp;lt;source name="Branch-Capture"&amp;gt;    &amp;lt;filters summary="last 15s"&amp;gt;      &amp;lt;filter&amp;gt;tf:OffsetTimeframe?15:SECONDS&amp;lt;/filter&amp;gt;    &amp;lt;/filters&amp;gt;  &amp;lt;/source&amp;gt;  &amp;lt;reportheader&amp;gt;    &amp;lt;reportdetails&amp;gt;      &amp;lt;user&amp;gt;kl4m&amp;lt;/user&amp;gt;    &amp;lt;/reportdetails&amp;gt;  &amp;lt;/reportheader&amp;gt;  &amp;lt;data&amp;gt;    &amp;lt;chartdashlet name="Heap Utilization" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="Memory Utilization" color="#c00000" aggregation="Average" unit="%" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344900000" avg="43.397125244140625" min="43.397125244140625" max="43.397125244140625" sum="43.397125244140625" count="1"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="Failed Transactions" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="Failed Transaction Percentage" color="#cd1919" aggregation="Average" unit="%" thresholds="true" drawingorder="1"&amp;gt;&amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="Web Page Response" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;source&amp;gt;        &amp;lt;filters summary="last 5 minutes"&amp;gt;          &amp;lt;filter&amp;gt;tf:Last5Min&amp;lt;/filter&amp;gt;        &amp;lt;/filters&amp;gt;      &amp;lt;/source&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="HttpStatusCode" color="#000000" aggregation="Last" unit="num" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344690000" avg="200.0" min="200.0" max="200.0" sum="200.0" count="1"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="JVM Availability" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="JVM Availability - BC" color="#c080c0" aggregation="Last" unit="num" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344900000" avg="20.0" min="20.0" max="20.0" sum="20.0" count="1"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="JDBC Pool" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="JDBC Connection Pool Percent Used" color="#004080" aggregation="Average" unit="%" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344900000" avg="0.0" min="0.0" max="0.0" sum="0.0" count="2"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="Response Time" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="Web Page Requests" color="#0000c0" aggregation="Average" unit="ms" thresholds="true" drawingorder="1"&amp;gt;&amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;  &amp;lt;/data&amp;gt;&amp;lt;/dashboardreport&amp;gt;

avg =   43.397125244140625      
    max =   43.397125244140625      
    measure =   Memory Utilization      
    min =   43.397125244140625      
    name =  CBOSYS_Application_Status       
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Any help is extremely appreciated&lt;/P&gt;</description>
    <pubDate>Wed, 15 Aug 2018 14:59:34 GMT</pubDate>
    <dc:creator>gkwl22000</dc:creator>
    <dc:date>2018-08-15T14:59:34Z</dc:date>
    <item>
      <title>xml rest import not spltting into envents</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/xml-rest-import-not-spltting-into-envents/m-p/409065#M100254</link>
      <description>&lt;P&gt;I have a dashboard xml export from another app. the xml does not appear to be forrmatted as true xml using &amp;lt;&amp;gt; for some sections. in the sample code below I need the break on each section starting with chartdashlet (ie each section is an event). I have added the following line in the props.conf &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;BREAK_ONLY_BEFORE = (?m)^(&amp;lt;chartdashlet)
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;the regex is supposed to cause the break before each chartdashlet entry&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;Sourcetype props.conf entry:
[dynatrace_cbosys_xml]
SHOULD_LINEMERGE = true
#LINE_BREAKER = }(,){
BREAK_ONLY_BEFORE = (?m)^(&amp;lt;chartdashlet)
SEDCMD-remove_header = s/\{\"meta.+?data\":\[//g
SEDCMD-remove_footer = s/\]\}//g
TRUNCATE = 0
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The xml input still comes in as one event. See sample xml event below:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;?xml version="1.0" encoding="utf-8"?&amp;gt;&amp;lt;dashboardreport name="CBOSYS_Application_Status" version="7.0.7.1013" reportdate="2018-08-15T10:55:06.637-04:00" description=""&amp;gt;  &amp;lt;source name="Branch-Capture"&amp;gt;    &amp;lt;filters summary="last 15s"&amp;gt;      &amp;lt;filter&amp;gt;tf:OffsetTimeframe?15:SECONDS&amp;lt;/filter&amp;gt;    &amp;lt;/filters&amp;gt;  &amp;lt;/source&amp;gt;  &amp;lt;reportheader&amp;gt;    &amp;lt;reportdetails&amp;gt;      &amp;lt;user&amp;gt;kl4m&amp;lt;/user&amp;gt;    &amp;lt;/reportdetails&amp;gt;  &amp;lt;/reportheader&amp;gt;  &amp;lt;data&amp;gt;    &amp;lt;chartdashlet name="Heap Utilization" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="Memory Utilization" color="#c00000" aggregation="Average" unit="%" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344900000" avg="43.397125244140625" min="43.397125244140625" max="43.397125244140625" sum="43.397125244140625" count="1"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="Failed Transactions" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="Failed Transaction Percentage" color="#cd1919" aggregation="Average" unit="%" thresholds="true" drawingorder="1"&amp;gt;&amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="Web Page Response" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;source&amp;gt;        &amp;lt;filters summary="last 5 minutes"&amp;gt;          &amp;lt;filter&amp;gt;tf:Last5Min&amp;lt;/filter&amp;gt;        &amp;lt;/filters&amp;gt;      &amp;lt;/source&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="HttpStatusCode" color="#000000" aggregation="Last" unit="num" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344690000" avg="200.0" min="200.0" max="200.0" sum="200.0" count="1"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="JVM Availability" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="JVM Availability - BC" color="#c080c0" aggregation="Last" unit="num" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344900000" avg="20.0" min="20.0" max="20.0" sum="20.0" count="1"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="JDBC Pool" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="JDBC Connection Pool Percent Used" color="#004080" aggregation="Average" unit="%" thresholds="true" drawingorder="1"&amp;gt;          &amp;lt;measurement timestamp="1534344900000" avg="0.0" min="0.0" max="0.0" sum="0.0" count="2"&amp;gt;&amp;lt;/measurement&amp;gt;        &amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;    &amp;lt;chartdashlet name="Response Time" description="" showabsolutevalues="false"&amp;gt;      &amp;lt;measures structuretype="tree"&amp;gt;        &amp;lt;measure measure="Web Page Requests" color="#0000c0" aggregation="Average" unit="ms" thresholds="true" drawingorder="1"&amp;gt;&amp;lt;/measure&amp;gt;      &amp;lt;/measures&amp;gt;    &amp;lt;/chartdashlet&amp;gt;  &amp;lt;/data&amp;gt;&amp;lt;/dashboardreport&amp;gt;

avg =   43.397125244140625      
    max =   43.397125244140625      
    measure =   Memory Utilization      
    min =   43.397125244140625      
    name =  CBOSYS_Application_Status       
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;Any help is extremely appreciated&lt;/P&gt;</description>
      <pubDate>Wed, 15 Aug 2018 14:59:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/xml-rest-import-not-spltting-into-envents/m-p/409065#M100254</guid>
      <dc:creator>gkwl22000</dc:creator>
      <dc:date>2018-08-15T14:59:34Z</dc:date>
    </item>
  </channel>
</rss>

