Dashboards & Visualizations

How come changes in my XML unstructured file are not reflected when I select "BREAK_ONLY_BEFORE?"

riqbal
Communicator
<?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33xxxxxxx22947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:0xx:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.2xxxxxxxxxxxx475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

hi everyone
I have one unstructured xml file. the event supposed to be start from "<Interceptor>"
while uploading the file, I select BREAK_ONLY_BEFORE= but seems that changes are not reflecting

[xyz  ]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
TIME_FORMAT=%Y-%m-%d
TIME_PREFIX=<ActionDate>
MAX_TIMESTAMP_LOOKAHEAD=100
BREAK_ONLY_BEFORE=<Interceptor> 
Tags (2)
0 Karma
1 Solution

cw15147
New Member

I was having the same problem, and the LINE_BREAKER solution posted above appears to solve my problem, but I wanted to understand why BREAK_ONLY_BEFORE didn't work. I made it work by inserting a newline into the XML. So riqbal's data would look like this:

<?xml version="1.0" encoding="UTF-8" ?><dataroot>
<Interceptor><AttackCoords>-80.33xxxxxxx22947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:0xx:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.2xxxxxxxxxxxx475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

Then I got exactly the result I wanted (events being identified by a specific XML tag).

This result makes sense, because the functional description for BREAK_ONLY_BEFORE is "When set, Splunk software creates a new event only if it encounters a new line that matches the regular expression." (Emphasis added.) In riqbal's data, Splunk won't find "a new line" with <Interceptor> in it, unless he has multi-line data and the string appears again in another line. Additionally, anything that is also in the line that is before the tag (e.g., closing tags for the previous event, which is my situation) will also be part of the next event.

LINE_BREAKER seems to be the better solution, however, since no editing of the XML is needed. FYI, this line (edited to match the preceding example) in props.conf work for me:

LINEBREAKER=([\r\n]*)\<Interceptor
0 Karma

niketn
Legend

@riqbal converted your comment to answer. Please accept to mark as answered. Do up vote the other answer that has helped.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

3no
Communicator

Hi,

It's regex format, try this :

  BREAK_ONLY_BEFORE = \<Interceptor\>

3no

0 Karma

riqbal
Communicator

not working, the xml file is without breaks.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...