I am puzzled why I cannot configure Splunk to break on what appears to be simple
My XML looks like this (a snippet)
<?xml etc .. with <Document ...> ... </Document> tags
What I want to do is treat the <Document ...> ... </Document> as an event
I've tried using MUST BREAK AFTER = </Document>
and with and without BREAK ONLY BEFORE
Splunk is stubbornly breaking part way thru my intended event
I have tried escaping the < and > and even the escaping the / too
But no joy ... it should be simple based on what I have read and the XML seems well formed ... I am puzzled
Aha, I've solved it and found this answer especially relevant to my problem
http://answers.splunk.com/answers/88201/need-help-with-event-breaking-in-xml-log-file
The fix for my file was to use this in props.conf in Advanced Mode in Data Inputs
BREAK_ONLY_BEFORE=<Document
MUST_BREAK_AFTER=<\/Document>
Aha, I've solved it and found this answer especially relevant to my problem
http://answers.splunk.com/answers/88201/need-help-with-event-breaking-in-xml-log-file
The fix for my file was to use this in props.conf in Advanced Mode in Data Inputs
BREAK_ONLY_BEFORE=<Document
MUST_BREAK_AFTER=<\/Document>
Are you sure that you're editing the correct file? In the correct place? In the correct way? On the correct splunk instance? Please provide more information regarding your config, including the relevant stanzas from the config files.
/K