Dashboards & Visualizations

Line_breaker separates in un-explained ways

Explorer

I have the following xml file all in one single line

For readibility, the file is shown as follows

&ltevent&gt...&lt/event&gt
&ltlabel1&gt ... &lt/label1&gt
&ltlabel2&gt ... &ltlabel2&gt
&ltlabel3&gt ... &lt/label3&gt
...
&ltevent&gt...&lt/event&gt
&ltlabel1&gt ... &lt/label1&gt
&ltlabel2&gt ... &ltlabel2&gt
&ltlabel3&gt ... &lt/label3&gt
...
In order to parse the xml file, my approach is to first break each event to reside on a single line by itself. As follows props.conf only includes the two statements below (no other statement such as timestamps, etc.) to ensure that events are parsed correctly

&#35 To delimit event by event "&ltevent&gt .... &lt/event&gt
&#35 Splunk now knows that each event is on a single line
LINEBREAKER = (&ltevent)
SHOULD
LINEMERGE = false

However this first step - as configured - fails as event splitting falls on some boundary that I have not been able to explain. This happens whether in data preview mode or search mode. BTW, line breaking happens differently in line mode vs search mode.

Can someone explain what happens and suggest a solution?

Thank you.

0 Karma

Legend

Try escaping the <

LINE_BREAKER = \<event
SHOULD_LINEMERGE = false
0 Karma