Getting Data In

Logs with XML data is being read as two separate events by Splunk

venksel
Explorer

Hi There Folks!

Please refer screen shot of the original log file in a NotePad.
http://prntscr.com/w82jd1

Although its one single event, as illustrated with a red line separator, Splunk UF is reading it as two separate events with diff time stamps.  I did read about MAX_EVENTS and TRUNCATE and my props.conf in UF and Indexer is updated to the following:

 

[default]
MAX_EVENTS = 100000
TRUNCATE = 100000
BREAK_ONLY_BEFORE_DATE = false

However, the problem persists. Any insights on what might be causing this issue?  Thanks for your help in advance.

Cheers

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi, @venksel,

Adding below TIME_PREFIX should help, Splunk is trying to guess event boundaries with timestamps. Since you have two timestamps in your event, you get two separate events.

You should put this props.conf to your indexer(s).

 

[xmlsourcetype]
TIME_PREFIX = [-]{12}[\r\n]+

 

 

 

If this reply helps you an upvote is appreciated.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...