XML Log File Question

[wlsplunker]

Hi all,

I have an XML log file that looks something like this.

<matrix>
    <datasource>
    <name>ABC</name>
    </datasource>
    <datasource>
    <name>XYZ</name>
    </datasource>

    <datasource>
    <name>EFG</name>
    </datasource>
    <datasource>
    <name>RST</name>
    </datasource>
</matrix>

Basically, this is one big file that updates itself every 5 minutes and should be

read as a single entry for each refresh. Unfortunately, Splunk reads that

seperately and chops them up when parsing.

Is there a way to tell Splunk that it should read from and end at

for each event?

[alacercogitatus]

Yes there is and can be done in two ways.

1. use data preview (under New Data Input) to generate the sourcetype and event breaking for this file "matrix" for example.
2. use props.conf to configure event breaking (see sections on BREAK_ONLY_BEFORE...)

http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf

[lguinn2]

No, because props.conf is organized into stanzas. The stanza header says which object (source, sourcetype or host) will be affected by the settings.

[wlsplunker]

if by using (2), it says "When set, Splunk creates a new event only if it encounters a new line that matches the
regular expression.". Would that mean my other logs (which are not configured this way) will be impacted someway?