XML file, Breaking before and/or after matching <Document> .. </Document> tags

[miken_hg5]

I am puzzled why I cannot configure Splunk to break on what appears to be simple ... tags

My XML looks like this (a snippet)

<?xml etc .. with <Document ...> ... </Document> tags

What I want to do is treat the <Document ...> ... </Document> as an event

I've tried using MUST BREAK AFTER = </Document>

and with and without BREAK ONLY BEFORE

Splunk is stubbornly breaking part way thru my intended event

I have tried escaping the < and > and even the escaping the / too

But no joy ... it should be simple based on what I have read and the XML seems well formed ... I am puzzled

[miken_hg5 · Accepted solution]

Aha, I've solved it and found this answer especially relevant to my problem

http://answers.splunk.com/answers/88201/need-help-with-event-breaking-in-xml-log-file

The fix for my file was to use this in props.conf in Advanced Mode in Data Inputs

BREAK_ONLY_BEFORE=<Document

MUST_BREAK_AFTER=<\/Document>

[kristian_kolb]

Are you sure that you're editing the correct file? In the correct place? In the correct way? On the correct splunk instance? Please provide more information regarding your config, including the relevant stanzas from the config files.

/K