Getting Data In

spunk data input - xml

syloee
Explorer

This is data file(<Interceptor>~~~</Interceptor><Interceptor>~~~</Interceptor>)

<?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:07:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

-> i want to this ↓

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

i use
LINE_BREAKER = <Interceptor>
MUST_BREAK_AFTER = \</Interceptor\>

but i can't do.

What can I do? 

Labels (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @syloee 

You can try following, make sure you set TIME* stamp extractions as well. Following works for event starts with <Interceptor> and the same tag would be truncated you won't find it in the event. These settings should be deployed to HF/indexer.

[ __auto__learned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\<Interceptor\>)
NO_BINARY_CHECK=true

----

An upvote would be appreciated and Accept solution if it helps!

 

Tags (1)
0 Karma

syloee
Explorer

thank you very much

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@syloee Hope it helped. Appreciate if you could Accept solution.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...