Dashboards & Visualizations

How to configure XML tags as search parameters when a single log file contains multiple XML events?

vinaykumar2020
New Member

Hi,

We just started working on Splunk. We have a single log file with multiple XMLs with line breaker ####################### as below (Build with same schema). We need some help on configuring XML tags as search parameter.

<?xml version='1.0'?> 
 <Log>
         <HOST>127.0.0.1</HOST>
         <DATE>10-04-2016T12:12:12</DATE>
         <TRANSACTIONID>OpportunityId</TRANSACTIONID>
         <TRANSACTIONVALUE>dsd767dsdkXSAre</TRANSACTIONVALUE>
         <APPLICATION>QuoteSync</Application> 
</Log>
#######################  
<?xml version='1.0'?>  
<Log>
         <HOST>127.0.0.1</HOST>
         <DATE>10-04-2016T12:12:12</DATE>
         <TRANSACTIONID>OpportunityId</TRANSACTIONID>
           <TRANSACTIONVALUE>dsd767dsdkXSAre</TRANSACTIONVALUE>
         <APPLICATION>QuoteSync</Application> 
</Log>

Thanks,
Vinay

0 Karma
1 Solution

somesoni2
Revered Legend

Try this for your sourcetype definition (props.conf on Indexer/Heavy forwarder)

[YourSourceType]
LINE_BREAKER = (#+\s*[\r\n]+)
SHOULD_LINEMERGE = false
TIME_PREFIX=\<DATE\>
TIME_FORMAT = %m-%d-%Y%%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this for your sourcetype definition (props.conf on Indexer/Heavy forwarder)

[YourSourceType]
LINE_BREAKER = (#+\s*[\r\n]+)
SHOULD_LINEMERGE = false
TIME_PREFIX=\<DATE\>
TIME_FORMAT = %m-%d-%Y%%H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 19
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...