When I insert an event and call the "services/search/jobs/export" REST endpoint, the XML that comes back is malformed and breaks XML parsing. There is another empty results document appended after the end of the document. Here is an example (with some valid result elements elided). Any idea what could be causing this and how to work around it? We're running Splunk 4.2.3 on Windows 32. <?xml version='1.0' encoding='UTF-8'?> <results preview='0'> <meta> <fieldOrder> <field>_cd</field> <field>_indextime</field> <field>_raw</field> <field>_serial</field> <field>_si</field> <field>_sourcetype</field> <field>_subsecond</field> <field>_time</field> <field>host</field> <field>index</field> <field>linecount</field> <field>source</field> <field>sourcetype</field> <field>splunk_server</field> </fieldOrder> </meta> <messages> <msg type="DEBUG">base lispy: [ AND group ]</msg> <msg type="DEBUG">search context: user="admin", app="search", bs-pathname="C:\splunk\etc"</msg> </messages> <result offset='0'> <field k='_cd'> <value><text>1:51</text></value> </field> <field k='_indextime'> <value><text>1320939650</text></value> </field> <field k='_raw'><v xml:space='preserve' trunc='0'>1320939650437 event-type=&quot;Test&quot; component=&quot;Job Controller&quot; giraffe-server=&quot;wlon1907051257&quot; <sg h='1'>group</sg>=&quot;cd290e81-75ca-4df6-b3e2-896d8085dc7b&quot; sequence=&quot;1&quot;</v></field> <field k='_serial'> <value><text>0</text></value> </field> <field k='_si'> <value><text>wlon1907051257</text></value> <value><text>main</text></value> </field> <field k='_sourcetype'> <value><text>giraffe-audit</text></value> </field> <field k='_subsecond'> <value><text>.437</text></value> </field> <field k='_time'> <value><text>2011-11-10 15:40:50.437 GMT Standard Time</text></value> </field> <field k='host'> <value><text>localhost</text></value> </field> <field k='index'> <value><text>main</text></value> </field> <field k='linecount'> <value><text>1</text></value> </field> <field k='source'> <value><text>giraffe-localdev</text></value> </field> <field k='sourcetype'> <value><text>giraffe-audit</text></value> </field> <field k='splunk_server'> <value><text>wlon1907051257</text></value> </field> </result> <result offset='1'> .... </result> </results> <results preview='0'> <meta> <fieldOrder /> </meta> </results> <results preview='0'> <meta> <fieldOrder /> </meta> </results> <results preview='0'> <meta> <fieldOrder /> </meta> </results> ... View more

The CLI command "add tcp ..." does not allow one to set the sourcename of the input source that it creates. How can one set it through the CLI? ... View more

Our application generates many small monitoring events. We are feeding these to Splunk by TCP. We would like to keep a single connection open between each of our processes and the Splunk TCP input. However, when we do this the events do not appear when sent over the TCP connection, but only when the TCP stream is closed. Then they all appear together as a single event. How do we configure the TCP input to generate one event per line as they stream in, instead of treating all data received over the connection as a single event? ... View more