topic Re: Why is line breaking not working as expected for my XML data when I edit .conf files directly? in Getting Data In

Why is line breaking not working as expected for my XML data when I edit .conf files directly?

gagi76 — Mon, 23 May 2016 10:04:17 GMT

Hi everyone,

Can someone please explain why these steps won't work? XML file that I input in Splunk are one event, like this:

inputs.conf

[monitor://c:/to_the_file]
Sourcetype = aaa

props.conf

[aaa]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)

I have tried this from Splunk Web (upload file and configured SHOULD_LINEMERGE = false and
LINE_BREAKER = ([\r\n]*)) and it worked, but when I do it from .conf files, it won't. Any ideas?
And of course, how can I configure date and time to be recognized from Splunk?

Thanks

Re: Why is line breaking not working as expected for my XML data when I edit .conf files directly?

gagi76 — Mon, 23 May 2016 10:06:36 GMT

misspell :
LINE_BREAKER = ([\r\n]*)

Re: Why is line breaking not working as expected for my XML data when I edit .conf files directly?

somesoni2 — Mon, 23 May 2016 16:45:15 GMT

Give this a try

props.conf

[aaa]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=\<LOG\>)
TIME_PREFIX = DATE\>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27

Re: Why is line breaking not working as expected for my XML data when I edit .conf files directly?

gagi76 — Tue, 24 May 2016 06:53:04 GMT

Thanks for helping,

ok, we broke logs now with those lines, but the date and time are not recognized from splunk. I have read that I should make datetime.xml file a configure it along with props.conf?