topic Re: XML Log Line Breaking and Timestamps in Getting Data In

XML Log Line Breaking and Timestamps

skansi — Thu, 07 Aug 2014 12:11:33 GMT

Hello, I have a problem I could use some help with.

I need to extract data from a XML log file (entries are labelled ) in Splunk. I have to upload an XML log file, and it uploads as a text string. Here is the XML sample:

<LOG><ENTRY><VRIJEME>2010-08-12T10:38:26</VRIJEME><CC>9369175136276314</CC><IZNOS>6427.91</IZNOS></ENTRY><ENTRY><VRIJEME>1998-06-17T04:13:55</VRIJEME><CC>6675476885047681</CC><IZNOS>72452.87</IZNOS></ENTRY>......</LOG>

I use ISO time (YYYY-MM-DDTHH:MM:SS). This way Splunk automatically recognized the first timestamp in the string. I want to break the text in separate events so that Splunk can take the timestamp from each line.

I tried to add LINE_BREAKER = ([\r\n]*)<ENTRY> (this worked for the non-ISO time, where Splunk did not recognize the timestamp), but Splunk gets stuck at 100%.

Thanks! Cheers!

Re: XML Log Line Breaking and Timestamps

skansi — Thu, 07 Aug 2014 12:13:19 GMT

Sorry, the forum ate up the backslashes:
LINE_BREAKER = ([backslashrbackslashn]*)

Re: XML Log Line Breaking and Timestamps

somesoni2 — Thu, 07 Aug 2014 13:53:16 GMT

Try something like this in you porps.conf.

[yoursourcetype]
BREAK_ONLY_BEFORE = ([\r\n]*)\<ENTRY\>
NO_BINARY_CHECK = 1
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
TIME_PREFIX = VRIJEME\>

Re: XML Log Line Breaking and Timestamps

skansi — Thu, 07 Aug 2014 17:09:52 GMT

Thanks, it worked!

Re: XML Log Line Breaking and Timestamps

skansi — Mon, 28 Sep 2020 17:17:19 GMT

I only had to kodify it slightly to

[xmltest2]
LINE_BREAKER = ([\r\n]*)<ENTRY>
NO_BINARY_CHECK = 1
TIME_FORMAT = %Y-%m-%dT%H:%M:%S
TIME_PREFIX = VRIJEME>