Splunk Search

Reading a xml file when file is split in to two

sasireka
Loves-to-Learn Lots

We are having a issue. Sometimes our input XML file is splint in to two.

sasireka_0-1619012717690.png

In the above image you can see, both are same files but last 6 lines are split in to another.

So when we read the file using 'spath' we are getting null value.

Example file in correct format :
<?xml version="1.0" encoding="UTF-8"?><message>
<software-version>4.1.1810-65</software-version>
<customer-job-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001</customer-job-id>
<submission>
<submit-number>1</submit-number>
<job-submission-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001.s1</job-submission-id>
<frame-inches-along-web-initial-value>10.850</frame-inches-along-web-initial-value>
<frame-inches-across-web>17.000</frame-inches-across-web>
<statistics>
<current-copy/>
<actual-linear-feet-used>3515.5</actual-linear-feet-used>
<sides>
<side-a>
<frames-printed-ok>3844</frames-printed-ok>
<frames-printed-error>0</frames-printed-error>
</side-a>
<side-b>
<frames-printed-ok>3844</frames-printed-ok>
<frames-printed-error>0</frames-printed-error>
</side-b>
</sides>
<ink-usage>
<units>liters</units>
<sides>
<side-a completed="true">
<fixer>0.004482</fixer>
<black>0.01374</black>
<cyan>0.002765</cyan>
<magenta>0.007962</magenta>
<yellow>0.000572</yellow>
</side-a>
<side-b completed="true">
<fixer>0.003547</fixer>
<black>0.01467</black>
<cyan>0.002751</cyan>
<magenta>0.009444</magenta>
<yellow>0.00047</yellow>
</side-b>
</sides>
</ink-usage>
</statistics>
</submission>
</message>

Example file in another format :

File 1:

<?xml version="1.0" encoding="UTF-8"?><message>
<software-version>4.1.1810-65</software-version>
<customer-job-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001</customer-job-id>
<submission>
<submit-number>1</submit-number>
<job-submission-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001.s1</job-submission-id>
<frame-inches-along-web-initial-value>10.850</frame-inches-along-web-initial-value>
<frame-inches-across-web>17.000</frame-inches-across-web>
<statistics>
<current-copy/>
<actual-linear-feet-used>3515.5</actual-linear-feet-used>
<sides>
<side-a>
<frames-printed-ok>3844</frames-printed-ok>
<frames-printed-error>0</frames-printed-error>
</side-a>
<side-b>
<frames-printed-ok>3844</frames-printed-ok>
<frames-printed-error>0</frames-printed-error>
</side-b>
</sides>
<ink-usage>
<units>liters</units>
<sides>
<side-a completed="true">
<fixer>0.004482</fixer>
<black>0.01374</black>
<cyan>0.002765</cyan>
<magenta>0.007962</magenta>
<yellow>0.000572</yellow>
</side-a>
<side-b completed="true">
<fixer>0.003547</fixer>
<black>0.01467</black>
<cyan>0.002751</cyan>
<magenta>0.009444</magenta>
<yellow>0.00047</yellow>

File 2:


</side-b>
</sides>
</ink-usage>
</statistics>
</submission>
</message>

Query :

(index="sample_*") sourcetype=sample_job_xml |where host="XP251" | where source="apc/def/722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001"
| spath input=_raw path=message.customer-job-id output=customer-job-id
| spath input=_raw path=message.submission output=submission
| spath input=submission path=job-submission-id output=job-submission-id
| spath input=submission path=statistics.actual-linear-feet-used output=actual-linear-feet-used
| spath input=submission path=frame-inches-across-web output=frame-inches-across-web
| spath input=submission path=frame-inches-along-web output=frame-inches-along-web
| spath input=submission path=job-manifest.end-range.side-a.copy-relative-frame-number output=side-a.copy-relative-frame-number
| spath input=submission path=job-manifest.end-range.side-b.copy-relative-frame-number output=side-b.copy-relative-frame-number
| spath input=submission path=statistics.sides.side-a.frames-printed-ok output=side-a.frames-printed-ok
| spath input=submission path=statistics.sides.side-b.frames-printed-ok output=side-b.frames-printed-ok
| spath input=submission path=statistics.ink-usage.sides.side-a.fixer output=side-a.fixer | spath input=submission path=statistics.ink-usage.sides.side-b.fixer output=side-b.fixer
| spath input=submission path=statistics.ink-usage.sides.side-a.black output=sides.side-a.black | spath input=submission path=statistics.ink-usage.sides.side-b.black output=side-b.black
| spath input=submission path=statistics.ink-usage.sides.side-a.cyan output=side-a.cyan | spath input=submission path=statistics.ink-usage.sides.side-b.cyan output=side-b.cyan
| spath input=submission path=statistics.ink-usage.sides.side-a.magenta output=side-a.magenta | spath input=submission path=statistics.ink-usage.sides.side-b.magenta output=side-b.magenta
| spath input=submission path=statistics.ink-usage.sides.side-a.yellow output=side-a.yellow | spath input=submission path=statistics.ink-usage.sides.side-b.yellow output=side-b.yellow
| fields host,source,customer-job-id,job-submission-id,actual-linear-feet-used,frame-inches-across-web,frame-inches-along-web,side-a.copy-relative-frame-number,side-b.copy-relative-frame-number,side-a.frames-printed-ok,side-b.frames-printed-ok,side-a.fixer,side-b.fixer,sides.side-a.black,side-b.black,side-a.cyan,side-b.cyan,side-a.magenta,side-b.magenta,side-a.yellow,side-b.yellow
|eval res=substr('customer-job-id',0,9), numberString=replace(if(like(res, "%v1_%"), mvindex(split(res,"_"),1), if(like(res, "%%"),mvindex(split(res,"-"),0),res)),"\D","") ,Jobnumber=if('customer-job-id'="startup-calibration","Diagnostic",if(len(numberString)=6,numberString,"UnKnown"))
| table host,source,Jobnumber,customer-job-id,job-submission-id,actual-linear-feet-used,frame-inches-across-web,frame-inches-along-web,side-a.copy-relative-frame-number,side-b.copy-relative-frame-number,side-a.frames-printed-ok,side-b.frames-printed-ok,side-a.fixer,side-b.fixer,sides.side-a.black,side-b.black,side-a.cyan,side-b.cyan,side-a.magenta,side-b.magenta,side-a.yellow,side-b.yellow | fillnull value="NULL" | where host="XP251"  and 'customer-job-id'="722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001"

sample result

sasireka_1-1619015233234.png


Here  in have to get the values instead of null when the file is split in to two. Thanks in advance

Labels (4)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try adjusting the  time_before_close and  multiline_event_extra_waittime settings in inputs.conf for that file.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>