Logs with XML data is being read as two separate events by Splunk

venksel — Tue, 22 Dec 2020 20:33:57 GMT

Hi There Folks!

Please refer screen shot of the original log file in a NotePad.
http://prntscr.com/w82jd1

Although its one single event, as illustrated with a red line separator, Splunk UF is reading it as two separate events with diff time stamps. I did read about MAX_EVENTS and TRUNCATE and my props.conf in UF and Indexer is updated to the following:

[default]
MAX_EVENTS = 100000
TRUNCATE = 100000
BREAK_ONLY_BEFORE_DATE = false

However, the problem persists. Any insights on what might be causing this issue? Thanks for your help in advance.

Cheers

Re: Logs with XML data is being read as two separate events by Splunk

scelikok — Fri, 25 Dec 2020 20:37:09 GMT

Hi, @venksel,

Adding below TIME_PREFIX should help, Splunk is trying to guess event boundaries with timestamps. Since you have two timestamps in your event, you get two separate events.

You should put this props.conf to your indexer(s).

[xmlsourcetype] TIME_PREFIX = [-]{12}[\r\n]+

If this reply helps you an upvote is appreciated.

topic Logs with XML data is being read as two separate events by Splunk in Getting Data In

Logs with XML data is being read as two separate events by Splunk

Re: Logs with XML data is being read as two separate events by Splunk