Getting Data In

KV_Mode Splunk 6 not Working

slierninja
Communicator

We have an XML log file that properly gets extracted in Splunk 5, but in Splunk 6 it doesn't properly identify the events. Events seem to be occurring at random in the search results - it doesn't seem to be honoring the KV_Mode. We get 5 events listed with only 2 XML events being sent.

Input XML (2 Events)

<CustomEvent>
<CreatedOn>2013-09-29T16:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:login</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>

<EventDetails />
</Body>
</CustomEvent>
<CustomEvent>
<CreatedOn>2013-09-29T18:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:logout</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>

<EventDetails />
</Body>
</CustomEvent>

Output Events (5 Events)

  1. <CustomEvent>
  2. <CreatedOn>2013-09-29T18:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:logout</EventType2>
  3. <EventDateTime>2013-09-29T16:47:12</EventDateTime>
    <EventDetails /> </Body> </CustomEvent>
  4. <EventDateTime>2013-09-29T16:47:12</EventDateTime>
    <EventDetails /> </Body> </CustomEvent> <CustomEvent>
  5. <CreatedOn>2013-09-29T16:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:login</EventType2>
0 Karma
1 Solution

slierninja
Communicator

This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.

[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

View solution in original post

0 Karma

slierninja
Communicator

This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.

[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...