I am forwarding in the XML versions of the Exchange Management logs from my Exchange servers. The XML log entries come into Splunk Cloud just fine but have no line breaks, like this when I do a search on the index:
1410x8000000000000080934MSExchange ManagementXXX.XXX.XXX.XXXSet-Mailbox-Identity "Xxxxx Xxxxxx" -EmailAddresses ("SMTP:xxxx.xxxx@xxxx.com","X400:C=US;A= ;P=XXX XXX;O=XXXXXX - HQ;S=XXXXXX;G=XXXXX;")xxxx.xxxxx.com/XXXX OU/XXXX XXXXS-1-5-21-103706718-2002142400-1307212239-2863S-1-5-21-103706718-2002142400-1307212239-2863Local-ECP-Unknown27180w3wp#MSExchangeECPAppPool9900:00:00.4843728View Entire Forest: 'True', Configuration Domain Controller: 'xxxxx.xxxxx.xxxx', Preferred Global Catalog: 'xxxx.xxxx.xxxx', PreferredDomainControllers: '{xxx.xxx.xxx }'Fal se0 objects execution has been proxied to remote server.0ActivityId: 064ebca7-2f3d-4967-a4e5-fb26fc403404ServicePlan:;IsAdmin:True;en-US
I have a props.conf for this data but obviously, it's not working properly. Here is the stanza for the props.conf, so any suggestions for getting this data to break properly and be more readable when search would be greatly appreciated. Thank you.
[xml:data]
KV_MODE = xml
SHOULD_LINEMERGE=false
NO_BINARY_CHECK=true
CHARSET=UTF-8
disabled=false
LINE_BREAKER=([\r\n\s]+)\
TRUNCATE = 100000
