Logs with XML data is being read as two separate events by Splunk

[venksel]

Hi There Folks!

Please refer screen shot of the original log file in a NotePad.
http://prntscr.com/w82jd1

Although its one single event, as illustrated with a red line separator, Splunk UF is reading it as two separate events with diff time stamps.  I did read about MAX_EVENTS and TRUNCATE and my props.conf in UF and Indexer is updated to the following:

[default]
MAX_EVENTS = 100000
TRUNCATE = 100000
BREAK_ONLY_BEFORE_DATE = false

However, the problem persists. Any insights on what might be causing this issue?  Thanks for your help in advance.

Cheers

[scelikok]

Hi, @venksel,

Adding below TIME_PREFIX should help, Splunk is trying to guess event boundaries with timestamps. Since you have two timestamps in your event, you get two separate events.

You should put this props.conf to your indexer(s).

[xmlsourcetype]
TIME_PREFIX = [-]{12}[\r\n]+

If this reply helps you an upvote is appreciated.