Getting Data In

spunk data input - xml

syloee
Explorer

This is data file(<Interceptor>~~~</Interceptor><Interceptor>~~~</Interceptor>)

<?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:07:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

-> i want to this ↓

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

i use
LINE_BREAKER = <Interceptor>
MUST_BREAK_AFTER = \</Interceptor\>

but i can't do.

What can I do? 

Labels (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @syloee 

You can try following, make sure you set TIME* stamp extractions as well. Following works for event starts with <Interceptor> and the same tag would be truncated you won't find it in the event. These settings should be deployed to HF/indexer.

[ __auto__learned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\<Interceptor\>)
NO_BINARY_CHECK=true

----

An upvote would be appreciated and Accept solution if it helps!

 

Tags (1)
0 Karma

syloee
Explorer

thank you very much

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@syloee Hope it helped. Appreciate if you could Accept solution.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...