Dashboards & Visualizations

Duplicated events indexing xml file

Cris
Explorer

Hi,

I've a simple xml file to index. The problem is that every time a new event is added the entire xml file is reindexed.
The reason is that the new event is added not at the end of the xml file but before the last line (xml closing tag).

Below the xml example file. You can see the header (first line), the footer (last line) and two events (between tag "Log"):

<?xml version="1.0" encoding="UTF-8"?><Sla>
<Log>
<Global>
<Target>DCxyz</Target>
<MethodName>FSE.pubblicDocument</MethodName>
<TrackID>141211804696927646</TrackID>
<Timestamp>01-10-2014 01:00:00</Timestamp>
</Global>
</Log>
<Log>
<Global>
<Target>DCxyz</Target>
<MethodName>FSE.pubblicDocument</MethodName>
<TrackID>141211809118823145</TrackID>
<Timestamp>01-10-2014 02:00:00</Timestamp>
</Global>
</Log>
</Sla>

Any idea to avoid this behaviour?

Thanks a lot.

Tags (3)
0 Karma
1 Solution

mcronkrite
Splunk Employee
Splunk Employee

You could break up the XML into individual events by the using Global xml tag.

In props.conf
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+) Global>
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_PREFIX = TIMESTAMP>
KV_MODE = xml

View solution in original post

0 Karma

mcronkrite
Splunk Employee
Splunk Employee

You could break up the XML into individual events by the using Global xml tag.

In props.conf
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+) Global>
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_PREFIX = TIMESTAMP>
KV_MODE = xml

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...