Dashboards & Visualizations

Line_breaker separates in un-explained ways

Thuan
Explorer

I have the following xml file all in one single line

For readibility, the file is shown as follows

&ltevent&gt...&lt/event&gt
&ltlabel1&gt ... &lt/label1&gt
&ltlabel2&gt ... &ltlabel2&gt
&ltlabel3&gt ... &lt/label3&gt
...
&ltevent&gt...&lt/event&gt
&ltlabel1&gt ... &lt/label1&gt
&ltlabel2&gt ... &ltlabel2&gt
&ltlabel3&gt ... &lt/label3&gt
...
In order to parse the xml file, my approach is to first break each event to reside on a single line by itself. As follows props.conf only includes the two statements below (no other statement such as timestamps, etc.) to ensure that events are parsed correctly

&#35 To delimit event by event "&ltevent&gt .... &lt/event&gt
&#35 Splunk now knows that each event is on a single line
LINE_BREAKER = (&ltevent)
SHOULD_LINEMERGE = false

However this first step - as configured - fails as event splitting falls on some boundary that I have not been able to explain. This happens whether in data preview mode or search mode. BTW, line breaking happens differently in line mode vs search mode.

Can someone explain what happens and suggest a solution?

Thank you.

0 Karma

sundareshr
Legend

Try escaping the <

LINE_BREAKER = \<event
SHOULD_LINEMERGE = false
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...