I am new to Splunk and am still trying to figure out everything one step at a time. I have an issue where the streaming XML data is expecting a tag and is instead receiving something else. The warning that shows up in splunkd.log is the following:
WARN ExecProcessor - Streaming XML data: Expected tag "event", instead received "error".
Is anyone familiar with this issue? And if so, where do I even start to troubleshoot it? I don't know what file to go to check the tags or the error.
Any help would be gladly appreciated. Thanks in advance!
I guess you installed the Splunk CIM Addon? In this case, about all Events containing the word "error" or similar words will get the tag "error". This is defined by a serach in the eventtypes.conf of the Splunk CIM AddOn:
[err0r] search = NOT sourcetype=stash (error OR failure OR fail OR failed OR fatal) NOT "not an error" #tag = error
## error [eventtype=err0r] error = enabled