Splunk Search
Highlighted

Why is KV_MODE=xml not working in my distributed environment?

Path Finder

Hi,

i'm using a distributed splunk setup (search head with several indexers) with version 6.1.3. I'm having problems with automatic field extractions from xml data.

Linebreaking is configured and working correctly. Extracting fields using spath is also working.

My props.conf on the indexers:

[mysourcetype]
KV_MODE=xml
BREAK_ONLY_BEFORE=<record>
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

props.conf on the searchhead:

[mysourcetype]
KV_MODE=xml

Example of the xml data:

<record>
<date>Fri Sep 05 08:02:32 CEST 2014</date>
<a>b</a>
<b>c</b>
</record>
<record>
<date>Fri Sep 05 08:02:33 CEST 2014</date>
<a>d</a>
<b>e</b>
</record>

On a standalone test system, the automatic extraction with KV_MODE=xml is working fine.

Any ideas why this isn't working in my distributed environment?

Thanks!

Highlighted

Re: Why is KV_MODE=xml not working in my distributed environment?

Legend

If Splunk looks at your data and thinks it is not entirely XML, it will not obey the KV_MODE=xml.
You did put the spec in the right place.

Perhaps the subset of data that you are using for test is better XML than the real production data.

0 Karma
Highlighted

Re: Why is KV_MODE=xml not working in my distributed environment?

Communicator

My guess is that the application containing the props.conf needs different permissions (App-permissions -> Global)

0 Karma
Highlighted

Re: Why is KV_MODE=xml not working in my distributed environment?

Communicator

Same problem here - the permissions are set to Global for the app-permissions. My data is from Applocker Wineventlog imported using renderxml=true

0 Karma
Highlighted

Re: Why is KV_MODE=xml not working in my distributed environment?

Engager

Is there an answer for this problem!? I've also have the same issue after move from my standalone system to a cluster (1y searchhead, 1x master, 3x peernodes).

0 Karma