topic Re: XML Log File Question in Getting Data In

XML Log File Question

wlsplunker — Thu, 14 Mar 2013 11:10:46 GMT

Hi all,

I have an XML log file that looks something like this.

<matrix>
    <datasource>
    <name>ABC</name>
    </datasource>
    <datasource>
    <name>XYZ</name>
    </datasource>

    <datasource>
    <name>EFG</name>
    </datasource>
    <datasource>
    <name>RST</name>
    </datasource>
</matrix>

Basically, this is one big file that updates itself every 5 minutes and should be

read as a single entry for each refresh. Unfortunately, Splunk reads that

seperately and chops them up when parsing.

Is there a way to tell Splunk that it should read from and end at

for each event?

Re: XML Log File Question

alacercogitatus — Mon, 28 Sep 2020 13:30:45 GMT

Yes there is and can be done in two ways.

use data preview (under New Data Input) to generate the sourcetype and event breaking for this file "matrix" for example.
use props.conf to configure event breaking (see sections on BREAK_ONLY_BEFORE...)

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

Re: XML Log File Question

wlsplunker — Fri, 15 Mar 2013 01:57:45 GMT

if by using (2), it says "When set, Splunk creates a new event only if it encounters a new line that matches the
regular expression.". Would that mean my other logs (which are not configured this way) will be impacted someway?

Re: XML Log File Question

lguinn2 — Fri, 15 Mar 2013 02:03:07 GMT

No, because props.conf is organized into stanzas. The stanza header says which object (source, sourcetype or host) will be affected by the settings.