Getting Data In
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
Solved! Jump to solution

KV_Mode Splunk 6 not Working

slierninja
Communicator
‎10-02-2013 09:22 AM

We have an XML log file that properly gets extracted in Splunk 5, but in Splunk 6 it doesn't properly identify the events. Events seem to be occurring at random in the search results - it doesn't seem to be honoring the KV_Mode. We get 5 events listed with only 2 XML events being sent.

Input XML (2 Events)

<CustomEvent>
<CreatedOn>2013-09-29T16:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:login</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>

<EventDetails />
</Body>
</CustomEvent>
<CustomEvent>
<CreatedOn>2013-09-29T18:47:12</CreatedOn>
<EventType>urn:mycustomevent</EventType>
<Body>
<EventType2>action:logout</EventType2>
<EventDateTime>2013-09-29T16:47:12</EventDateTime>

<EventDetails />
</Body>
</CustomEvent>

Output Events (5 Events)

  1. <CustomEvent>
  2. <CreatedOn>2013-09-29T18:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:logout</EventType2>
  3. <EventDateTime>2013-09-29T16:47:12</EventDateTime>
    <EventDetails /> </Body> </CustomEvent>
  4. <EventDateTime>2013-09-29T16:47:12</EventDateTime>
    <EventDetails /> </Body> </CustomEvent> <CustomEvent>
  5. <CreatedOn>2013-09-29T16:47:12</CreatedOn> <EventType>urn:mycustomevent</EventType> <Body> <EventType2>action:login</EventType2>
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

slierninja
Communicator
‎10-02-2013 02:30 PM

This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.

[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

slierninja
Communicator
‎10-02-2013 02:30 PM

This had nothing to do with Splunk 6. I was missing the following in my props.config. This was done in etc/system/local/props.config at a global scope in our PROD configuration, but wasn't present in our DEV instance apps/customApp/local/props.config local scope.

[customsourcetype]
BREAK_ONLY_BEFORE = ^<CustomEvent
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml
0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...