Getting Data In

spunk data input - xml

syloee
Explorer

This is data file(<Interceptor>~~~</Interceptor><Interceptor>~~~</Interceptor>)

<?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:07:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

-> i want to this ↓

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

i use
LINE_BREAKER = <Interceptor>
MUST_BREAK_AFTER = \</Interceptor\>

but i can't do.

What can I do? 

Labels (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @syloee 

You can try following, make sure you set TIME* stamp extractions as well. Following works for event starts with <Interceptor> and the same tag would be truncated you won't find it in the event. These settings should be deployed to HF/indexer.

[ __auto__learned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\<Interceptor\>)
NO_BINARY_CHECK=true

----

An upvote would be appreciated and Accept solution if it helps!

 

Tags (1)
0 Karma

syloee
Explorer

thank you very much

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@syloee Hope it helped. Appreciate if you could Accept solution.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...