Getting Data In

XML indexing using TRUNCATE and crcSalt together fails

lmacneil76
Explorer

Having a hard time getting this right, if (TRUNCATE = 0) or (crcSalt = ) are used by theselfs they work. Does inputs.conf disable the props.conf settings in some way?

------- My setup -------

props.conf this is on the splunk server

[source::C:\\var\\xml\\*]
MAX_EVENTS = 100000
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = true
KV_MODE = xml

inputs.conf this is on my forwarder

[monitor://c:\var\xml\*.xml]
disabled = 0
followTail = 0
crcSalt = <SOURCE>
initCrcLength = 2048
0 Karma
1 Solution

lmacneil76
Explorer

Found my own solution, adding sourcetype and pointing to the props.conf.

**props.conf**
[qtixml]
SHOULD_LINEMERGE = true
MAX_EVENTS = 500000
LINE_BREAKER = </assessmentItem>
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = xml

**inputs.conf** 
[monitor://c:\var\xml\]
disabled = 0
followTail = 0
sourcetype= qtixml
crcSalt = <SOURCE>

View solution in original post

lmacneil76
Explorer

Found my own solution, adding sourcetype and pointing to the props.conf.

**props.conf**
[qtixml]
SHOULD_LINEMERGE = true
MAX_EVENTS = 500000
LINE_BREAKER = </assessmentItem>
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = xml

**inputs.conf** 
[monitor://c:\var\xml\]
disabled = 0
followTail = 0
sourcetype= qtixml
crcSalt = <SOURCE>
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...