how to split events?

[deeptha1992]

I have configured REST API and I am getting data into splunk in XML format. But all the data as a single event it is showing and it contains more that 3000 lines in my event. I want to split the event by job id, ie. each job id should have separate events. How it possible?
Thanks in advance.

[pruthvikrishnap]

You will have to create a custom response handler in vi /opt/splunk/etc/apps/Restta/bin/responsehandler.py, something like this basing on the data you are querying.
class AlarmHandler:

     def __init__(self,**args):
         pass

     def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
         if response_type == "xml": 
             import xml.etree.ElementTree as ET
             alarm_list = ET.fromstring(encodeXMLText(raw_response_output))
             for alarm in alarm_list:
                 alarm_xml_str = ET.tostring(alarm, encoding='utf8', method='xml')
                 print_xml_stream(alarm_xml_str)               

         else:
             print_xml_stream(raw_response_output) 

[chli_splunk]

If you use REST API input, unfortunately it only supports JSON. You can try to:
1. Check if it's possible to get JSON response rather than XML. Some REST endpoint accepts parameters like ?format=json in the URL
2. Switch to Python code input in AoB. You need to right some basic Python codes to send request, then parse the XML and do whatever you want before indexing them.

[burwell]

Can you provide sample data? Do you have time stamps per job?