Getting Data In

xml rest import not spltting into envents

gkwl22000
New Member

I have a dashboard xml export from another app. the xml does not appear to be forrmatted as true xml using <> for some sections. in the sample code below I need the break on each section starting with chartdashlet (ie each section is an event). I have added the following line in the props.conf

BREAK_ONLY_BEFORE = (?m)^(<chartdashlet)

the regex is supposed to cause the break before each chartdashlet entry

Sourcetype props.conf entry:
[dynatrace_cbosys_xml]
SHOULD_LINEMERGE = true
#LINE_BREAKER = }(,){
BREAK_ONLY_BEFORE = (?m)^(<chartdashlet)
SEDCMD-remove_header = s/\{\"meta.+?data\":\[//g
SEDCMD-remove_footer = s/\]\}//g
TRUNCATE = 0

The xml input still comes in as one event. See sample xml event below:

<?xml version="1.0" encoding="utf-8"?><dashboardreport name="CBOSYS_Application_Status" version="7.0.7.1013" reportdate="2018-08-15T10:55:06.637-04:00" description="">  <source name="Branch-Capture">    <filters summary="last 15s">      <filter>tf:OffsetTimeframe?15:SECONDS</filter>    </filters>  </source>  <reportheader>    <reportdetails>      <user>kl4m</user>    </reportdetails>  </reportheader>  <data>    <chartdashlet name="Heap Utilization" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Memory Utilization" color="#c00000" aggregation="Average" unit="%" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="43.397125244140625" min="43.397125244140625" max="43.397125244140625" sum="43.397125244140625" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="Failed Transactions" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Failed Transaction Percentage" color="#cd1919" aggregation="Average" unit="%" thresholds="true" drawingorder="1"></measure>      </measures>    </chartdashlet>    <chartdashlet name="Web Page Response" description="" showabsolutevalues="false">      <source>        <filters summary="last 5 minutes">          <filter>tf:Last5Min</filter>        </filters>      </source>      <measures structuretype="tree">        <measure measure="HttpStatusCode" color="#000000" aggregation="Last" unit="num" thresholds="true" drawingorder="1">          <measurement timestamp="1534344690000" avg="200.0" min="200.0" max="200.0" sum="200.0" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="JVM Availability" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="JVM Availability - BC" color="#c080c0" aggregation="Last" unit="num" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="20.0" min="20.0" max="20.0" sum="20.0" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="JDBC Pool" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="JDBC Connection Pool Percent Used" color="#004080" aggregation="Average" unit="%" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="0.0" min="0.0" max="0.0" sum="0.0" count="2"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="Response Time" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Web Page Requests" color="#0000c0" aggregation="Average" unit="ms" thresholds="true" drawingorder="1"></measure>      </measures>    </chartdashlet>  </data></dashboardreport>

avg =   43.397125244140625      
    max =   43.397125244140625      
    measure =   Memory Utilization      
    min =   43.397125244140625      
    name =  CBOSYS_Application_Status       

Any help is extremely appreciated

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...