I have the following xml file all in one single line
For readibility, the file is shown as follows
<event>...</event>
<label1> ... </label1>
<label2> ... <label2>
<label3> ... </label3>
...
<event>...</event>
<label1> ... </label1>
<label2> ... <label2>
<label3> ... </label3>
...
In order to parse the xml file, my approach is to first break each event to reside on a single line by itself. As follows props.conf only includes the two statements below (no other statement such as timestamps, etc.) to ensure that events are parsed correctly
# To delimit event by event "<event> .... </event>
# Splunk now knows that each event is on a single line
LINE_BREAKER = (<event)
SHOULD_LINEMERGE = false
However this first step - as configured - fails as event splitting falls on some boundary that I have not been able to explain. This happens whether in data preview mode or search mode. BTW, line breaking happens differently in line mode vs search mode.
Can someone explain what happens and suggest a solution?
Thank you.
