XML extractions not working in 6

[theouhuios]

Hello

I did try XML extractions before on 4.3 which used to work fine. But in 6 I seem to have an issue.

Here is my config

BREAK_ONLY_BEFORE =^\<\?xml
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

And the data looks like

<?xml version="1.0" encoding="UTF-8" ?>
<ResultSetData>
<Row>
<Column name="DATE_TIME">2/21/2014 9:35:53</Column>
<Column name="HOST_NAME">xxxxx</Column>
<Column name="INSTANCE_NAME">yyyyy</Column>
<Column name="USERNAME">aaaaaa</Column>
<Column name="PROFILE">zzzzz</Column>
<Column name="ACCOUNT_STATUS">ccccc</Column>
</Row>
</ResultSetData>

Line breaking and timestamp looks good but the field extractions doesn't seem to work.Any ideas?

When I use spath that works again

[theouhuios]

Any idea if this can be done?

[aelliott]

we have it in the format etc and it works great
In addition, you probably just want to start with the tag right? so you could do break only before ^<ResultSetData etc?

[theouhuios]

I did that too . Line Break isn't really a problem here as I am not really particular about it. Looks like I will have to change the format of the XML now. Is there no way for us to make splunk do those extractions in KV_MODE as XML?

[theouhuios]

Is it the 2/21/2014 9:35:53 format which is creating an issue? I know that its like 2/21/2014 9:35:53 it wont have any issues. Should I change the format ?