topic Re: Why is KV_MODE=xml not working in my distributed environment? in Splunk Search

Why is KV_MODE=xml not working in my distributed environment?

HansWurscht — Fri, 05 Sep 2014 06:27:37 GMT

Hi,

i'm using a distributed splunk setup (search head with several indexers) with version 6.1.3. I'm having problems with automatic field extractions from xml data.

Linebreaking is configured and working correctly. Extracting fields using spath is also working.

My props.conf on the indexers:

[mysourcetype]
KV_MODE=xml
BREAK_ONLY_BEFORE=<record>
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

props.conf on the searchhead:

[mysourcetype]
KV_MODE=xml

Example of the xml data:

<record>
<date>Fri Sep 05 08:02:32 CEST 2014</date>
<a>b</a>
<b>c</b>
</record>
<record>
<date>Fri Sep 05 08:02:33 CEST 2014</date>
<a>d</a>
<b>e</b>
</record>

On a standalone test system, the automatic extraction with KV_MODE=xml is working fine.

Any ideas why this isn't working in my distributed environment?

Thanks!

Re: Why is KV_MODE=xml not working in my distributed environment?

lguinn2 — Mon, 08 Sep 2014 01:19:26 GMT

If Splunk looks at your data and thinks it is not entirely XML, it will not obey the KV_MODE=xml.
You did put the spec in the right place.

Perhaps the subset of data that you are using for test is better XML than the real production data.

Re: Why is KV_MODE=xml not working in my distributed environment?

bravon — Fri, 07 Aug 2015 09:27:07 GMT

My guess is that the application containing the props.conf needs different permissions (App-permissions -> Global)

Re: Why is KV_MODE=xml not working in my distributed environment?

bravon — Thu, 19 May 2016 09:32:39 GMT

Same problem here - the permissions are set to Global for the app-permissions. My data is from Applocker Wineventlog imported using renderxml=true

Re: Why is KV_MODE=xml not working in my distributed environment?

seilemor — Tue, 09 Jan 2018 15:39:29 GMT

Is there an answer for this problem!? I've also have the same issue after move from my standalone system to a cluster (1y searchhead, 1x master, 3x peernodes).