Splunk Search

Splunk Logging

sumanth_sun
New Member

I have a XML payload like below which is getting logged in Splunk. However when i search in Splunk with customer email , the log is getting truncated and i can see lines only before REGISTEREDTIME. The lines after REGISTEREDTIME are getting split to some unknown threads and am not able to pull up entire log in Splunk. Can anyone help

<CUSTOMEREMAIL>somedummyemail</CUSTOMEREMAIL>

<FIRSTNAME>Somename</FIRSTNAME>

<LASTNAME>Somename</LASTNAME>

<REGISTEREDTIME>2020-09-15T12:05:00Z</REGISTEREDTIME>

<PREFIX>Mr</PREFIX>

<LOGGEDIN>NO<LOGGEDIN>

<LOYALCUSTOMER>YES<LOYALCUSTOMER>

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @sumanth_sun 

It is not entirely clear what you have in splunk and what search is not working. Can you show an example of the _raw data of a couple of your events and an example of the search which is not working? Obviously, obscuring any sensitive data.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...