topic MAX_EVENTS in probs.conf issue. in Getting Data In

MAX_EVENTS in probs.conf issue.

rasty — Mon, 09 Apr 2018 06:33:18 GMT

Hello everyone,

I have a problem with props.conf.

My props.conf:

[test_cx1]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
KV_MODE = xml
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 99999
MUST_BREAK_AFTER = \</CxXMLResults>
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
description = Checkmarx
disabled = false
pulldown_type = 1

And I have a xml file:

<CxXMLResults ......>
     <Query .......>
          <Result ........>

          </Result>
     </Query>
</CxXMLResults>

So I want to a single event contain all CxXMLResults. How can i do this ? What is my wrong ?

As you can see breaks line after each 257 lines. But I set MAX_EVENTS to 99999.

Thanks your answers..

Re: MAX_EVENTS in probs.conf issue.

p_gurav — Mon, 09 Apr 2018 08:02:03 GMT

Can you try :

[test_cx1]
 DATETIME_CONFIG =
 KV_MODE = xml
 LINE_BREAKER = \<CxXMLResults\s*
 MAX_EVENTS = 99999
 NO_BINARY_CHECK = true
 TRUNCATE = 0
 category = Custom
 description = Checkmarx
 disabled = false
 pulldown_type = 1

Re: MAX_EVENTS in probs.conf issue.

rasty — Mon, 09 Apr 2018 08:34:13 GMT

hi @p_gurav,

I think splunk is having performance problems. Because, I am trying this props.conf:

[test_cx3]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 1000000
SHOULD_LINEMERGE = true
TRUNCATE = 0
pulldown_type = 1
KV_MODE = xml
NO_BINARY_CHECK = true
category = Custom
disabled = false
EVENT_BREAKER =
MUST_BREAK_AFTER = \</CxXMLResults>

I sent two Report to splunk 562000 lines and 547 lines. When I send 547 lines there is no problem. But When I send 562000 lines report, Splunk break lines randomly 100.000, 46.000, 150.000 e.g

Do you think, what could be the reason ?