Monitoring Splunk

getting only half of logs in the splunk from monitoring path

nasrinmulani
New Member

Hi All,

I have large XML file, i have indexed it using BREAK_ONLY_BEFORE and MUST_BREAK_AFT.
But i am getting partial events from not the whole.

From around 600, i am getting only 29 records.

I don't know whats the problem. I got this previously also.

Tags (1)
0 Karma

nasrinmulani
New Member

I have changes line breaker to BREAK_ONLY_BEFORE and MUST_BREAK_AFT previously.

0 Karma

sudosplunk
Motivator

Hello,

Can you provide your props.conf and some sample events.

0 Karma

nasrinmulani
New Member
<Head>
123
 </Head>
 <Detail>
 <id>123</id>
 <Name>x</Name>
 </Detail>
 </Head>
 <Head>
 <Detail>
 <id>1234</id>
 <Name>y</Name>
 </Detail>
 </Head>
 <Head>
 <Detail>
 <id>12347</id>
 <Name>y</Name>
 </Detail>
<Tail>234<Tail>

I am giving this example log, but logs are too large in the size.
I am breaking it by tag.
Following is props.conf

[sourcetypename] 
BREAK_ONLY_BEFORE = <Detail>
MUST_BREAK_AFTER = <\/Detail>
NO_BINARY_CHECK = true
category = Custom
description = For event breaking
disabled = false
pulldown_type = true
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...