Getting Data In

MAX_EVENTS in probs.conf issue.

rasty
Path Finder

Hello everyone,

I have a problem with props.conf.

My props.conf:

[test_cx1]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
KV_MODE = xml
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 99999
MUST_BREAK_AFTER = \</CxXMLResults>
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
description = Checkmarx
disabled = false
pulldown_type = 1

And I have a xml file:

<CxXMLResults ......>
     <Query .......>
          <Result ........>

          </Result>
     </Query>
</CxXMLResults>

So I want to a single event contain all CxXMLResults. How can i do this ? What is my wrong ?

alt text

As you can see breaks line after each 257 lines. But I set MAX_EVENTS to 99999.

Thanks your answers..

0 Karma
1 Solution

p_gurav
Champion

Can you try :

[test_cx1]
 DATETIME_CONFIG =
 KV_MODE = xml
 LINE_BREAKER = \<CxXMLResults\s*
 MAX_EVENTS = 99999
 NO_BINARY_CHECK = true
 TRUNCATE = 0
 category = Custom
 description = Checkmarx
 disabled = false
 pulldown_type = 1

View solution in original post

0 Karma

p_gurav
Champion

Can you try :

[test_cx1]
 DATETIME_CONFIG =
 KV_MODE = xml
 LINE_BREAKER = \<CxXMLResults\s*
 MAX_EVENTS = 99999
 NO_BINARY_CHECK = true
 TRUNCATE = 0
 category = Custom
 description = Checkmarx
 disabled = false
 pulldown_type = 1
0 Karma

rasty
Path Finder

hi @p_gurav,

I think splunk is having performance problems. Because, I am trying this props.conf:

[test_cx3]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 1000000
SHOULD_LINEMERGE = true
TRUNCATE = 0
pulldown_type = 1
KV_MODE = xml
NO_BINARY_CHECK = true
category = Custom
disabled = false
EVENT_BREAKER =
MUST_BREAK_AFTER = \</CxXMLResults>

I sent two Report to splunk 562000 lines and 547 lines. When I send 547 lines there is no problem. But When I send 562000 lines report, Splunk break lines randomly 100.000, 46.000, 150.000 e.g

Do you think, what could be the reason ?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...