Getting Data In

XML indexing using TRUNCATE and crcSalt together fails

lmacneil76
Explorer

Having a hard time getting this right, if (TRUNCATE = 0) or (crcSalt = ) are used by theselfs they work. Does inputs.conf disable the props.conf settings in some way?

------- My setup -------

props.conf this is on the splunk server

[source::C:\\var\\xml\\*]
MAX_EVENTS = 100000
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = true
KV_MODE = xml

inputs.conf this is on my forwarder

[monitor://c:\var\xml\*.xml]
disabled = 0
followTail = 0
crcSalt = <SOURCE>
initCrcLength = 2048
0 Karma
1 Solution

lmacneil76
Explorer

Found my own solution, adding sourcetype and pointing to the props.conf.

**props.conf**
[qtixml]
SHOULD_LINEMERGE = true
MAX_EVENTS = 500000
LINE_BREAKER = </assessmentItem>
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = xml

**inputs.conf** 
[monitor://c:\var\xml\]
disabled = 0
followTail = 0
sourcetype= qtixml
crcSalt = <SOURCE>

View solution in original post

lmacneil76
Explorer

Found my own solution, adding sourcetype and pointing to the props.conf.

**props.conf**
[qtixml]
SHOULD_LINEMERGE = true
MAX_EVENTS = 500000
LINE_BREAKER = </assessmentItem>
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = xml

**inputs.conf** 
[monitor://c:\var\xml\]
disabled = 0
followTail = 0
sourcetype= qtixml
crcSalt = <SOURCE>

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!