Getting Data In

xml rest import not spltting into envents

gkwl22000
New Member

I have a dashboard xml export from another app. the xml does not appear to be forrmatted as true xml using <> for some sections. in the sample code below I need the break on each section starting with chartdashlet (ie each section is an event). I have added the following line in the props.conf

BREAK_ONLY_BEFORE = (?m)^(<chartdashlet)

the regex is supposed to cause the break before each chartdashlet entry

Sourcetype props.conf entry:
[dynatrace_cbosys_xml]
SHOULD_LINEMERGE = true
#LINE_BREAKER = }(,){
BREAK_ONLY_BEFORE = (?m)^(<chartdashlet)
SEDCMD-remove_header = s/\{\"meta.+?data\":\[//g
SEDCMD-remove_footer = s/\]\}//g
TRUNCATE = 0

The xml input still comes in as one event. See sample xml event below:

<?xml version="1.0" encoding="utf-8"?><dashboardreport name="CBOSYS_Application_Status" version="7.0.7.1013" reportdate="2018-08-15T10:55:06.637-04:00" description="">  <source name="Branch-Capture">    <filters summary="last 15s">      <filter>tf:OffsetTimeframe?15:SECONDS</filter>    </filters>  </source>  <reportheader>    <reportdetails>      <user>kl4m</user>    </reportdetails>  </reportheader>  <data>    <chartdashlet name="Heap Utilization" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Memory Utilization" color="#c00000" aggregation="Average" unit="%" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="43.397125244140625" min="43.397125244140625" max="43.397125244140625" sum="43.397125244140625" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="Failed Transactions" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Failed Transaction Percentage" color="#cd1919" aggregation="Average" unit="%" thresholds="true" drawingorder="1"></measure>      </measures>    </chartdashlet>    <chartdashlet name="Web Page Response" description="" showabsolutevalues="false">      <source>        <filters summary="last 5 minutes">          <filter>tf:Last5Min</filter>        </filters>      </source>      <measures structuretype="tree">        <measure measure="HttpStatusCode" color="#000000" aggregation="Last" unit="num" thresholds="true" drawingorder="1">          <measurement timestamp="1534344690000" avg="200.0" min="200.0" max="200.0" sum="200.0" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="JVM Availability" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="JVM Availability - BC" color="#c080c0" aggregation="Last" unit="num" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="20.0" min="20.0" max="20.0" sum="20.0" count="1"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="JDBC Pool" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="JDBC Connection Pool Percent Used" color="#004080" aggregation="Average" unit="%" thresholds="true" drawingorder="1">          <measurement timestamp="1534344900000" avg="0.0" min="0.0" max="0.0" sum="0.0" count="2"></measurement>        </measure>      </measures>    </chartdashlet>    <chartdashlet name="Response Time" description="" showabsolutevalues="false">      <measures structuretype="tree">        <measure measure="Web Page Requests" color="#0000c0" aggregation="Average" unit="ms" thresholds="true" drawingorder="1"></measure>      </measures>    </chartdashlet>  </data></dashboardreport>

avg =   43.397125244140625      
    max =   43.397125244140625      
    measure =   Memory Utilization      
    min =   43.397125244140625      
    name =  CBOSYS_Application_Status       

Any help is extremely appreciated

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...