I am attempting to ingest an XML file but am getting stuck can someone please help. The data will ingest if I remove "BREAK_ONLY_BEFORE =\<item\>" but with a new event per item.
this is the XML and code I have tried
<?xml version="1.0" standalone="yes"?>
<DocumentElement>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T11:08:21+11:00</lastscandate>
<manufacturer>VMware, Inc.</manufacturer>
<model>VMware7,1</model>
<operatingsystem>Microsoft Windows 10 Enterprise</operatingsystem>
<ipaddress>168.132.11.200</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T12:20:21+11:00</lastscandate>
<manufacturer>Hewlett-Packard</manufacturer>
<model>HP Compaq Elite 8300 SFF</model>
<operatingsystem>Microsoft Windows 8.1 Enterprise</operatingsystem>
<ipaddress>168.132.136.160</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T11:54:28+11:00</lastscandate>
<manufacturer>HP</manufacturer>
<model>HP EliteBook 850 G5</model>
<operatingsystem>Microsoft Windows 10 Enterprise</operatingsystem>
<ipaddress>168.132.219.32, 192.168.1.221</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
<item>
<hierarchy>ASA</hierarchy>
<hostname>AComputer</hostname>
<lastscandate>2023-12-17T11:50:20+11:00</lastscandate>
<manufacturer>VMware, Inc.</manufacturer>
<model>VMware7,1</model>
<operatingsystem>Microsoft Windows 10 Enterprise</operatingsystem>
<ipaddress>168.132.11.251</ipaddress>
<vendor />
<lastloggedonuser>JohnSmith</lastloggedonuser>
<totalcost>0.00</totalcost>
</item>
Inputs.conf
[monitor://D:\SplunkImportData\SNOW\*.xml]
sourcetype=snow:all:devices
index=asgmonitoring
disabled = 0
Props.conf
[snow:all:devices]
KV_MODE=xml
BREAK_ONLY_BEFORE =\<item\>
SHOULD_LINEMERGE = false
DATETIME_CONFIG = NONE
When using BREAK_ONLY_BEFORE, set SHOULD_LINEMERGE = true.
[snow:all:devices]
KV_MODE=xml
BREAK_ONLY_BEFORE =\<item>
SHOULD_LINEMERGE = true
DATETIME_CONFIG = NONE