Getting Data In

xml rest import not spltting into envents

gkwl22000
New Member

I have a dashboard xml export from another app. the xml does not appear to be forrmatted as true xml using <> for some sections. in the sample code below I need the break on each section starting with chartdashlet (ie each section is an event). I have added the following line in the props.conf

BREAK_ONLY_BEFORE = (?m)^(<chartdashlet)

the regex is supposed to cause the break before each chartdashlet entry

Sourcetype props.conf entry:
[dynatrace_cbosys_xml]
SHOULD_LINEMERGE = true
#LINE_BREAKER = }(,){
BREAK_ONLY_BEFORE = (?m)^(<chartdashlet)
SEDCMD-remove_header = s/\{\"meta.+?data\":\[//g
SEDCMD-remove_footer = s/\]\}//g
TRUNCATE = 0

The xml input still comes in as one event. See sample xml event below:

<?xml version="1.0" encoding="utf-8"?><dashboardreport name="CBOSYS_Application_Status" version="7.0.7.1013" reportdate="2018-08-15T10:55:06.637-04:00" description="">  <source name="Branch-Capture">    <filters summary="last 15s">      <filter>tf:OffsetTimeframe?15:SECONDS</filter>    </filters>  </source>  <reportheader>    <reportdetails>      <user>kl4m</user>    </reportdetails>  </reportheader>  <data>    <chartdashlet name="Heap Utilization" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Memory Utilization" color="#c00000" aggregation="Average" unit="%" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="43.397125244140625" min="43.397125244140625" max="43.397125244140625" sum="43.397125244140625" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="Failed Transactions" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Failed Transaction Percentage" color="#cd1919" aggregation="Average" unit="%" thresholds="true" drawingorder="1"></measure>      </measures>    </chartdashlet>    <chartdashlet name="Web Page Response" description="" showabsolutevalues="false">      <source>        <filters summary="last 5 minutes">          <filter>tf:Last5Min</filter>        </filters>      </source>      <measures structuretype="tree">        <measure measure="HttpStatusCode" color="#000000" aggregation="Last" unit="num" thresholds="true" drawingorder="1">          <measurement timestamp="1534344690000" avg="200.0" min="200.0" max="200.0" sum="200.0" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="JVM Availability" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="JVM Availability - BC" color="#c080c0" aggregation="Last" unit="num" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="20.0" min="20.0" max="20.0" sum="20.0" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="JDBC Pool" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="JDBC Connection Pool Percent Used" color="#004080" aggregation="Average" unit="%" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="0.0" min="0.0" max="0.0" sum="0.0" count="2"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="Response Time" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Web Page Requests" color="#0000c0" aggregation="Average" unit="ms" thresholds="true" drawingorder="1"></measure>      </measures>    </chartdashlet>  </data></dashboardreport>

avg =   43.397125244140625      
    max =   43.397125244140625      
    measure =   Memory Utilization      
    min =   43.397125244140625      
    name =  CBOSYS_Application_Status       

Any help is extremely appreciated

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...