A very singular use case (I think) in indexing XML files.

[tcmarquesi]

I think I have a very particular scenario using XML files. At least I did not find somebody having the same issue here. There we go!

I would like to index this XMLs where:
1. Each file is an entire event, there isn't event break inside the file.
2. Inside the file there isn't timestamp, only in the file name.

So:
1. Which sourcetype may I choose in this scenario? Should I create a custom one?
2. How can I make splunk identify the timestamp properly?

I'll thank very much if somebody can help me, very much.

Regards,

Tiago

[somesoni2 · Accepted solution]

You should create your own custom sourcetype to handle all the custom things that you want to do. Add a impossible to find Line breaker for your events so that all data from the file will appear as one event. It will be very inefficient to have Splunk read timestamp from the filename as there is no direct way to do that. Also, only the date can be extracted from file name, not the time. See this for more details on how to configure timestamp recognition in Splunk and what's the order Splunk follows.
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/HowSplunkextractstimestamps#How_Splunk_softwa...

I would suggest you to use the current time (time when Splunk sees the file and reads it) as the timestamp. If everything is working fine and your application is generating files with latest timestamp, then using current time will be the closest anyways. My suggestion would be like this

[YourSourceTypeName]
SHOULD_LINEMERGE = false
LINE_BREAKER =([\r\n]+)(?=YouWillNeverFindThisPattern)
DATETIME_CONFIG = current
TRUNCATE = 25000        #default to 10000 character, adjust based on your file content).
KV_MODE = xml

[tcmarquesi]

Thank you @somesoni2 🙂