Dashboards & Visualizations

one xml file is split into mulitple event

SplunkCSIT
Communicator

how come when i forward one xml to indexer, it is split into multiple event, how to configure such that one xml is in one event? thks

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll need to set appropriate props.conf settings, see http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/propsconf

For your case, you're probably hitting maximum lines or bytes per event - consider adding these to your sourcetype's stanza:

MAX_EVENTS = a number large enough to accommodate your number of lines
TRUNCATE = a number large enough to accommodate your number of bytes
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at BREAK_ONLY_BEFORE in props.conf: http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/propsconf
You should be able to set that to the start of your events, and Splunk will break them accordingly.

0 Karma

SplunkCSIT
Communicator

The # of events is 1528 and the byte is ~118000. What would be your recommendation?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Well, beyond guessing that it might be a size-related issue I'm going to need more information about the data.

0 Karma

SplunkCSIT
Communicator

cannot work, i made the above changes, restart the splunk and the xml is still split into multiple events

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...