i'm using a distributed splunk setup (search head with several indexers) with version 6.1.3. I'm having problems with automatic field extractions from xml data.
Linebreaking is configured and working correctly. Extracting fields using spath is also working.
My props.conf on the indexers:
[mysourcetype] KV_MODE=xml BREAK_ONLY_BEFORE=<record> NO_BINARY_CHECK=1 SHOULD_LINEMERGE=true
props.conf on the searchhead:
Example of the xml data:
<record> <date>Fri Sep 05 08:02:32 CEST 2014</date> <a>b</a> <b>c</b> </record> <record> <date>Fri Sep 05 08:02:33 CEST 2014</date> <a>d</a> <b>e</b> </record>
On a standalone test system, the automatic extraction with KV_MODE=xml is working fine.
Any ideas why this isn't working in my distributed environment?
If Splunk looks at your data and thinks it is not entirely XML, it will not obey the
You did put the spec in the right place.
Perhaps the subset of data that you are using for test is better XML than the real production data.
Same problem here - the permissions are set to Global for the app-permissions. My data is from Applocker Wineventlog imported using renderxml=true
Is there an answer for this problem!? I've also have the same issue after move from my standalone system to a cluster (1y searchhead, 1x master, 3x peernodes).