PROPS Configuration for XML source

SplunkDash — Tue, 14 Sep 2021 04:02:38 GMT

Hello,

I have some issues writing PROPS configuration for XML source file. Sample XML events (2 Events) are given below. Any help will be highly appreciated. Thank you so much.

TIME_PREFIX=

TIME_FORMAT=

LINE_BREAKER=

--------------------------------

<Computer>XVL0SMEMAPPAGR14</Computer>

</System>

<TraceIdentifier>ATech.Notifications</TraceIdentifier>

<Description>Error sending the email message generated for notification template 'Employee Training - ' with id = '12552'.</Description>

<AppDomain>ATech.JobFramework.Job.exe</AppDomain>

<ExceptionType>ATech.Common.Exceptions.SendEmailNotificationException, ATech.Common, Version=6.4.10100.1051, Culture=neutral, PublicKeyToken=null</ExceptionType>

<Message>Error sending the email message generated for notification template 'Employee Training - with id = '12552'.</Message>

<Resolution>Please verify that the server configured in the ECPSA is reachable. For further support, please contact your system administrator.</Resolution>

<ServerAddress>Changeit-mail-relay</ServerAddress>

</ContextData>

<ExceptionType>System.Net.Mail.SmtpException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934a19</ExceptionType>

<Message>Failure sending mail.</Message>

<Source>System</Source>

<StackTrace> at System.Net.Mail.SmtpClient.Send(MailMessage message)

at ATech.Notifications.Providers.Mail.DefaultSmtpProvider.Send(MailMessage mailMessage, Notification notification)</StackTrace>

<ExceptionType>System.Net.WebException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=c77a52161934e08</ExceptionType>

<Message>The remote name could not be resolved</Message>

<Source>System</Source>

at System.Net.Mail.SmtpConnection.GetConnection(ServicePoint servicePoint)

at System.Net.Mail.SmtpClient.GetConnection()

at System.Net.Mail.SmtpClient.Send(MailMessage message)</StackTrace>

</InnerException>

</Exception>

</TraceRecord>

</DataItem>

</TraceData>

</ApplicationData>

</a2ETraceEvent>

<Computer>XVL0SMEMAPPAGR14</Computer>

</System>

<TraceIdentifier>ATech.Notifications</TraceIdentifier>

<Description>Error sending the email message generated for notification template 'Employee Training - ' with id = '237521.</Description>

<AppDomain>ATech.JobFramework.Job.exe</AppDomain>

<ExceptionType>ATech.Common.Exceptions.SendEmailNotificationException, ATech.Common, Version=6.4.10100.1051, Culture=neutral, PublicKeyToken=null</ExceptionType>

<Message>Error sending the email message generated for notification template 'Employee Training - with id = '237521'.</Message>

<Resolution>Please verify that the server configured in the ECPSA is reachable. For further support, please contact your system administrator.</Resolution>

<ServerAddress>Changeit-mail-relay</ServerAddress>

</ContextData>

<ExceptionType>System.Net.Mail.SmtpException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=g77a5c561944t16</ExceptionType>

<Message>Failure sending mail.</Message>

<Source>System</Source>

at ATech.Notifications.Providers.Mail.DefaultSmtpProvider.Send(MailMessage mailMessage, Notification notification)</StackTrace>

<ExceptionType>System.Net.WebException, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=c77c52161934r19</ExceptionType>

<Message>The remote name could not be resolved</Message>

<Source>System</Source>

<StackTrace> at System.Net.ServicePoint.GetConnection(PooledStream PooledStream, Object owner, Boolean async, IPAddress& address, Socket& abortSocket, Socket&)

at System.Net.Mail.SmtpConnection.GetConnection(ServicePoint servicePoint)

at System.Net.Mail.SmtpClient.GetConnection()

at System.Net.Mail.SmtpClient.Send(MailMessage message)</StackTrace>

</InnerException>

</Exception>

</TraceRecord>

</DataItem>

</TraceData>

</ApplicationData>

</a2ETraceEvent>

Re: PROPS Configuration for XML source

richgalloway — Tue, 14 Sep 2021 12:19:00 GMT

It would be helpful to know what you've tried already and what those results were, but these settings may help.

TIME_PREFIX = TimeCreated SystemTime=" TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%7N%Z MAX_TIMESTAMP_LOOKAHEAD = 30 LINE_BREAKER = ([\r\n]+)\<a2ETraceEvent SHOULD_LINEMERGE = false

Re: PROPS Configuration for XML source

SplunkDash — Tue, 14 Sep 2021 14:25:52 GMT

Thank you so much. Your codes are working as expected. My mistake was assigning TIME_FORMAT and LINE_BREAKER parameters. Thank you again, appreciated!

topic Re: PROPS Configuration for XML source in Splunk Search

PROPS Configuration for XML source

Re: PROPS Configuration for XML source

Re: PROPS Configuration for XML source