Getting Data In

Xml logs event separation

volkanyilmaz
New Member

Hi. I have 10000 xml log output. like :
{LOG
DATE.../DATE
TIME.../TIME
CC.../CC
AMOUNT.../AMOUNT
/LOG}
I need to break event after every .each event should like that between two tag. I am trying to change the configuration in the props.conf but I still could not break the event into LOG. I tried to configure in the props.conf like :

BREAK_ONLY_BEFORE = ([\r\n])LOG
LINE_BREAKER = ([\r\n]
)LOG
SHOULD_LINEMERGE = false

Thanks for in advance

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi volkanyilmaz,
try something like this:

LINE_BREAKER = \{LOG
SHOULD_LINEMERGE = false

Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...