Field extraction is working for one server but not for other by defining stanzas in props.conf.

setiad — Wed, 30 Sep 2020 00:49:28 GMT

I added the data into Splunk after changing the configuration in props.conf for breaking the event as per the need and for extracting the fields from xml data.

props.conf:-
[VTLservice]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = ()
MUST_BREAK_AFTER = \
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Custom
disabled = false
pulldown_type = true

inputs.conf:-
[rest://https:///storeonceservices/cluster/servicesets/1/services/vtl/libraries/all]
activation_key = 3C3FA5F032624FA3CAD44F2D37F87A8B
auth_password = password
auth_type = basic
auth_user = user
endpoint = https:///storeonceservices/cluster/servicesets/1/services/vtl/libraries/all
host =
http_method = GET
index = storeoncedata
index_error_response_codes = 0
polling_interval = 3600
response_type = xml
sequential_mode = 0
sourcetype = VTLservice
streaming_request = 0
url_args = media=xml

There was no problem on that particular instance .

But when i tried performing the same approach on another server,the events were breaking properly but fields were not getting extracted as before. So what could be the reason and solution for this.

topic Field extraction is working for one server but not for other by defining stanzas in props.conf. in Splunk Search

Field extraction is working for one server but not for other by defining stanzas in props.conf.