I am having issues when Splunk is reading an XML file. I need Splunk to know that a transaction starts with
I'm not sure what the regex I need for this is? and would I need to add it to props.conf or transforms.conf or something else?
<diary_entry> <id>560494</id> <entry_time>2011-08-25 12:36:00 UTC</entry_time> <blood_glucose>15.4</blood_glucose> <carbohydrate_portions>5</carbohydrate_portions> <quick_insulin>3</quick_insulin> <background_insulin></background_insulin> <ratio>1:1</ratio> <entry_type>CORR</entry_type> <target_min_bg>4.5</target_min_bg> <target_max_bg>7.5</target_max_bg> <ketones></ketones> <comments></comments> <injection_site>Stomach</injection_site> <updated_at>2011-08-25 22:44:02 UTC</updated_at> </diary_entry>
You need to add it as a
LINE_BREAKER directive in
props.conf. Like this:
[yoursourcetype] LINE_BREAKER = ([\r\n]+)<diary_entry>
and don't forget to also set
note that the latter may not be required if your timestamps are parsed correctly without it.
Already indexed data will not be altered by this operation. Any new data coming in should be broken into separate event according to your config.