topic Re: spunk data input - xml in Getting Data In

spunk data input - xml

syloee — Mon, 28 Jun 2021 05:27:42 GMT

This is data file(<Interceptor>~~~</Interceptor><Interceptor>~~~</Interceptor>)

<?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:07:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

-> i want to this ↓

i use
LINE_BREAKER = <Interceptor>
MUST_BREAK_AFTER = \</Interceptor\>

but i can't do.

What can I do?

Re: spunk data input - xml

venkatasri — Mon, 28 Jun 2021 06:07:54 GMT

Hi @syloee

You can try following, make sure you set TIME* stamp extractions as well. Following works for event starts with <Interceptor> and the same tag would be truncated you won't find it in the event. These settings should be deployed to HF/indexer.

[ __auto__learned__ ] SHOULD_LINEMERGE=false LINE_BREAKER=(\<Interceptor\>) NO_BINARY_CHECK=true

----

An upvote would be appreciated and Accept solution if it helps!

Re: spunk data input - xml

syloee — Mon, 28 Jun 2021 06:11:14 GMT

thank you very much

Re: spunk data input - xml

venkatasri — Mon, 28 Jun 2021 06:20:30 GMT

@syloee Hope it helped. Appreciate if you could Accept solution.