Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: KV_Mode Splunk 6 not Working
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have an XML log file that properly gets extracted in Splunk 5, but in Splunk 6 it doesn't properly identify the events. Events seem to be occurring at random in the search results - it doesn't seem to be honoring the KV_Mode. We get 5 events listed with only 2 XML events being sent.
Input XML (2 Events)
<CustomEvent>
<CreatedOn>2013-09-29T16:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:login</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>
<EventDetails />
</Body>
</CustomEvent>
<CustomEvent>
<CreatedOn>2013-09-29T18:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:logout</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>
<EventDetails />
</Body>
</CustomEvent>
Output Events (5 Events)
- <CustomEvent>
- <CreatedOn>2013-09-29T18:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:logout</EventType2>
- <EventDateTime>2013-09-29T16:47:12</EventDateTime>
<EventDetails /> </Body> </CustomEvent> - <EventDateTime>2013-09-29T16:47:12</EventDateTime>
<EventDetails /> </Body> </CustomEvent> <CustomEvent> - <CreatedOn>2013-09-29T16:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:login</EventType2>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.
[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.
[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...
Make your Splunk investment work harder with Optimization Advisor
How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26
