I added the data into Splunk after changing the configuration in props.conf for breaking the event as per the need and for extracting the fields from xml data.
props.conf:-
[VTLservice]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = ()
MUST_BREAK_AFTER = \
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRUNCATE = 0
category = Custom
disabled = false
pulldown_type = true
inputs.conf:-
[rest://https:///storeonceservices/cluster/servicesets/1/services/vtl/libraries/all]
activation_key = 3C3FA5F032624FA3CAD44F2D37F87A8B
auth_password = password
auth_type = basic
auth_user = user
endpoint = https:///storeonceservices/cluster/servicesets/1/services/vtl/libraries/all
host =
http_method = GET
index = storeoncedata
index_error_response_codes = 0
polling_interval = 3600
response_type = xml
sequential_mode = 0
sourcetype = VTLservice
streaming_request = 0
url_args = media=xml
There was no problem on that particular instance .
But when i tried performing the same approach on another server,the events were breaking properly but fields were not getting extracted as before. So what could be the reason and solution for this.
... View more