topic Re: one xml file is split into mulitple event in Dashboards & Visualizations

one xml file is split into mulitple event

SplunkCSIT — Tue, 01 Apr 2014 01:25:29 GMT

how come when i forward one xml to indexer, it is split into multiple event, how to configure such that one xml is in one event? thks

martin_mueller — Tue, 01 Apr 2014 09:21:28 GMT

For your case, you're probably hitting maximum lines or bytes per event - consider adding these to your sourcetype's stanza:

MAX_EVENTS = a number large enough to accommodate your number of lines
TRUNCATE = a number large enough to accommodate your number of bytes

SplunkCSIT — Fri, 04 Apr 2014 00:49:24 GMT

cannot work, i made the above changes, restart the splunk and the xml is still split into multiple events

martin_mueller — Fri, 04 Apr 2014 07:18:03 GMT

Well, beyond guessing that it might be a size-related issue I'm going to need more information about the data.

SplunkCSIT — Tue, 08 Apr 2014 02:07:32 GMT

The # of events is 1528 and the byte is ~118000. What would be your recommendation?

martin_mueller — Mon, 28 Sep 2020 16:20:14 GMT

Take a look at BREAK_ONLY_BEFORE in props.conf: http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/propsconf
You should be able to set that to the start of your events, and Splunk will break them accordingly.