BREAK_ONLY_BEFORE not working with XML input

[badrsplunk]

Hi,
I have an XML file input with the following form:

<data>
  <record>
   <field name="X" value="vX1">
   <field name="Y" value="vY1">
  </record>
  <record>
   <field name="X" value="vX2">
   <field name="Y" value="vY2">
  </record>
 </data>

In order to extract fields, I want to split this input to one event per each record. to do this, I tried this in props.conf:

      [sourcetype_name]
       ..
      BREAK_ONLY_BEFORE= (\<record\>)
      SHOULD_LINEMERGE = true

Unfortunately, it's not working for me.
Any ideas, please!

[woodcock]

Don't use BREAK_ONLY_BEFORE, use this:

[YourSourcetypeNameHere]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n\s]+\<record\>[\r\n\s]+)

[badrsplunk]

Always not working!! no
search data indexed. It's like, when i try to size events, no data indexed.

[woodcock]

These settings are correct, so it must be something else. If you are doing a sourcetype override/overwrite, you must use the ORIGINAL value, NOT the new value. You must deploy your settings to the first full instance(s) of Splunk that handle the events (usually either the HF tier if you use one, or else your Indexer tier) UNLESS you are using HEC's JSON endpoint (it gets pre-cooked) or INDEXED_EXTRACTIONS (configs go on the UF in that case), then restart all Splunk instances there. When (re)evaluating, you must send in new events (old events will stay broken), then test using _index_earliest=-5m to be absolutely certain that you are only examining the newly indexed events.

[richgalloway]

Your BREAK_ONLY_BEFORE value was eaten by the formatter. Please edit your question. To prevent the formatter from mangling the contents, indent each line of the props.conf file at least 4 spaces.

[codebuilder]

do you have kvmode=xml set?