Why is KV_MODE=xml not working in my distributed environment?

[HansWurscht]

Hi,

i'm using a distributed splunk setup (search head with several indexers) with version 6.1.3. I'm having problems with automatic field extractions from xml data.

Linebreaking is configured and working correctly. Extracting fields using spath is also working.

My props.conf on the indexers:

[mysourcetype]
KV_MODE=xml
BREAK_ONLY_BEFORE=<record>
NO_BINARY_CHECK=1
SHOULD_LINEMERGE=true

props.conf on the searchhead:

[mysourcetype]
KV_MODE=xml

Example of the xml data:

<record>
<date>Fri Sep 05 08:02:32 CEST 2014</date>
<a>b</a>
<b>c</b>
</record>
<record>
<date>Fri Sep 05 08:02:33 CEST 2014</date>
<a>d</a>
<b>e</b>
</record>

On a standalone test system, the automatic extraction with KV_MODE=xml is working fine.

Any ideas why this isn't working in my distributed environment?

Thanks!

[seilemor]

Is there an answer for this problem!? I've also have the same issue after move from my standalone system to a cluster (1y searchhead, 1x master, 3x peernodes).

[bravon]

Same problem here - the permissions are set to Global for the app-permissions. My data is from Applocker Wineventlog imported using renderxml=true

[bravon]

My guess is that the application containing the props.conf needs different permissions (App-permissions -> Global)

[lguinn2]

If Splunk looks at your data and thinks it is not entirely XML, it will not obey the KV_MODE=xml.
You did put the spec in the right place.

Perhaps the subset of data that you are using for test is better XML than the real production data.