I added the data into Splunk after changing the configuration in props.conf for breaking the event as per the need and for extracting the fields from xml data.
props.conf:-
[VTLservice]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = ()
MUST_BREAK_AFTER = \
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Custom
disabled = false
pulldown_type = true
inputs.conf:-
[rest://https:///storeonceservices/cluster/servicesets/1/services/vtl/libraries/all]
activation_key = 3C3FA5F032624FA3CAD44F2D37F87A8B
auth_password = password
auth_type = basic
auth_user = user
endpoint = https:///storeonceservices/cluster/servicesets/1/services/vtl/libraries/all
host =
http_method = GET
index = storeoncedata
index_error_response_codes = 0
polling_interval = 3600
response_type = xml
sequential_mode = 0
sourcetype = VTLservice
streaming_request = 0
url_args = media=xml
There was no problem on that particular instance .
But when i tried performing the same approach on another server,the events were breaking properly but fields were not getting extracted as before. So what could be the reason and solution for this.
