Getting Data In

spunk data input - xml

syloee
Explorer

This is data file(<Interceptor>~~~</Interceptor><Interceptor>~~~</Interceptor>)

<?xml version="1.0" encoding="UTF-8" ?><dataroot><Interceptor><AttackCoords>-80.33100097073213,25.10742916222947</AttackCoords><Outcome>Interdiction</Outcome><Infiltrators>23</Infiltrators><Enforcer>Ironwood</Enforcer><ActionDate>2013-04-24</ActionDate><ActionTime>00:07:00</ActionTime><RecordNotes></RecordNotes><NumEscaped>0</NumEscaped><LaunchCoords>-80.23429525620114,24.08680387475695</LaunchCoords><AttackVessel>Rustic</AttackVessel></Interceptor>

-> i want to this ↓

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

<Interceptor>~~~</Interceptor>

i use
LINE_BREAKER = <Interceptor>
MUST_BREAK_AFTER = \</Interceptor\>

but i can't do.

What can I do? 

Labels (3)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @syloee 

You can try following, make sure you set TIME* stamp extractions as well. Following works for event starts with <Interceptor> and the same tag would be truncated you won't find it in the event. These settings should be deployed to HF/indexer.

[ __auto__learned__ ]
SHOULD_LINEMERGE=false
LINE_BREAKER=(\<Interceptor\>)
NO_BINARY_CHECK=true

----

An upvote would be appreciated and Accept solution if it helps!

 

Tags (1)
0 Karma

syloee
Explorer

thank you very much

0 Karma

venkatasri
SplunkTrust
SplunkTrust

@syloee Hope it helped. Appreciate if you could Accept solution.

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...