Getting Data In

How to extract data from logfiles in XML format?

New Member

I have set up a universal forwarder to monitor my
server logfile. The file is written in XML format
and thus has a header and footer of:

<?xml version="1.0" encoding="UTF-8"?><rps_logfile version="1.0">

and:

</rps_logfile>

respectively.

As the server produces log output, it appends to the file by
backing up over the footer, writing the new entry, and re-writing
the footer.

This causes the universal forwarder to send redundant information
and the splunkd receiving the data seems to get confused sometimes.

What are my options for having the header & footer ignored or
having the forwarder send only the truly new information?

Tags (2)
0 Karma

New Member

I decided to indulge in a preprocessing approach.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!