Solved: Re: KV_Mode Splunk 6 not Working

slierninja · ‎10-02-2013

We have an XML log file that properly gets extracted in Splunk 5, but in Splunk 6 it doesn't properly identify the events. Events seem to be occurring at random in the search results - it doesn't seem to be honoring the KV_Mode. We get 5 events listed with only 2 XML events being sent.

Input XML (2 Events)

<CustomEvent>
<CreatedOn>2013-09-29T16:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:login</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>

<EventDetails />
</Body>
</CustomEvent>
<CustomEvent>
<CreatedOn>2013-09-29T18:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:logout</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>

<EventDetails />
</Body>
</CustomEvent>

Output Events (5 Events)

<CustomEvent>
<CreatedOn>2013-09-29T18:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:logout</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>
<EventDetails /> </Body> </CustomEvent>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>
<EventDetails /> </Body> </CustomEvent> <CustomEvent>
<CreatedOn>2013-09-29T16:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:login</EventType2>

slierninja · ‎10-02-2013

This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.

[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

View solution in original post

slierninja · ‎10-02-2013

This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.

[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

KV_Mode Splunk 6 not Working

Input XML (2 Events)

Output Events (5 Events)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation

KV_Mode Splunk 6 not Working

Input XML (2 Events)

Output Events (5 Events)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest