MAX_EVENTS in probs.conf issue.

[rasty]

Hello everyone,

I have a problem with props.conf.

My props.conf:

[test_cx1]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
KV_MODE = xml
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 99999
MUST_BREAK_AFTER = \</CxXMLResults>
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
description = Checkmarx
disabled = false
pulldown_type = 1

And I have a xml file:

<CxXMLResults ......>
     <Query .......>
          <Result ........>

          </Result>
     </Query>
</CxXMLResults>

So I want to a single event contain all CxXMLResults. How can i do this ? What is my wrong ?

As you can see breaks line after each 257 lines. But I set MAX_EVENTS to 99999.

Thanks your answers..

[p_gurav · Accepted solution]

Can you try :

[test_cx1]
 DATETIME_CONFIG =
 KV_MODE = xml
 LINE_BREAKER = \<CxXMLResults\s*
 MAX_EVENTS = 99999
 NO_BINARY_CHECK = true
 TRUNCATE = 0
 category = Custom
 description = Checkmarx
 disabled = false
 pulldown_type = 1

[rasty]

hi @p_gurav,

I think splunk is having performance problems. Because, I am trying this props.conf:

[test_cx3]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 1000000
SHOULD_LINEMERGE = true
TRUNCATE = 0
pulldown_type = 1
KV_MODE = xml
NO_BINARY_CHECK = true
category = Custom
disabled = false
EVENT_BREAKER =
MUST_BREAK_AFTER = \</CxXMLResults>

I sent two Report to splunk 562000 lines and 547 lines. When I send 547 lines there is no problem. But When I send 562000 lines report, Splunk break lines randomly 100.000, 46.000, 150.000 e.g

Do you think, what could be the reason ?