Getting Data In

XML Data Line Breaking on DateTime tag

ekenne06
Path Finder

Here is my data normally.

2021-01-26 00:00:44.2885 [INFO] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA:
<?xml version="1.0" encoding="utf-8"?>
<DCNSMessage>
  <ID>SIXPAC</ID>
  <RType>14</RType>
  <DateTime>2021-01-26T00:00:35Z</DateTime>
  <ActiveLink>
    <StartDateTime>2021-01-25T23:50:00Z</StartDateTime>
    <StopDateTime>2021-01-26T00:00:00Z</StopDateTime>
    <LocationActive>
      <Location>S-SLC01</Location>
      <Active>0</Active>
    </LocationActive>
  </ActiveLink>
</DCNSMessage>

 

for some reason when the data gets indexed, it's line breaking, so I only get the following data:

2021-01-26 00:00:44.2885 [INFO] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA:
<?xml version="1.0" encoding="utf-8"?>
<DCNSMessage>
  <ID>SIXPAC</ID>
  <RType>14</RType>

Any idea on why it's breaking at the DateTime tag? 

Labels (3)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @ekenne06,

Splunk breaks events when it finds a timestamp by default. You should set timestamp like below;

[your_sourcetype]
TIME_PREFIX = ^
TIMEFORMAT = %Y-%m-%d %H:%M:%S.%4Q

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

ekenne06
Path Finder

so I tried that and it's still breaking at that spot. I did a btool props --debug . Will update if I find anything there. Currently messing around with a few props.conf settings

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...