Splunk Logging

[sumanth_sun]

I have a XML payload like below which is getting logged in Splunk. However when i search in Splunk with customer email , the log is getting truncated and i can see lines only before REGISTEREDTIME. The lines after REGISTEREDTIME are getting split to some unknown threads and am not able to pull up entire log in Splunk. Can anyone help

<CUSTOMEREMAIL>somedummyemail</CUSTOMEREMAIL>

<FIRSTNAME>Somename</FIRSTNAME>

<LASTNAME>Somename</LASTNAME>

<REGISTEREDTIME>2020-09-15T12:05:00Z</REGISTEREDTIME>

<PREFIX>Mr</PREFIX>

<LOGGEDIN>NO<LOGGEDIN>

<LOYALCUSTOMER>YES<LOYALCUSTOMER>

[ITWhisperer]

Hi @sumanth_sun 

It is not entirely clear what you have in splunk and what search is not working. Can you show an example of the _raw data of a couple of your events and an example of the search which is not working? Obviously, obscuring any sensitive data.