Getting Data In

XML Log File in Error Tags

Kyle_Brandt
Path Finder

I have an application that creates XML log files. Each entry takes multiple lines and is enclosed in <error> </error> tags, but there are other tags with in it.

From reading other questions I believe I define a source type in the inputs.conf on the machine that has these logs files (light forwarder). If that is true then I believe I define the specifics of this source type in the props.conf file. Should that props.conf file be on the machine with the logs or the indexing machine. Also, what should that props.conf file look like for a file like this. Lastly, how will I clear the already indexed log entries (confused, they think it is one per line) and get it to reindex them properly?

Tags (1)
0 Karma

Genti
Splunk Employee
Splunk Employee
  • Line breaking / event breaking issues:
    Your xml file is not being parsed correctly and is creating single line events for an event that should be multiline. I assume also the timestamp recognition is wrong?
    Then what you need to do is use props.conf / transforms.conf in order to force splunk to linebreak the events correctly.

  • Since your forwarder is a light weight forwarder then you need to put these props/transforms on the INDEXER side.

  • Lastly, to clean your already indexed data you can use the clean command

hope this helps.
.gz

0 Karma

Genti
Splunk Employee
Splunk Employee

NOTE: use the clean command at your own risk, ie. you will lose data if you do not have the raw data still available...

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...