Getting Data In

XML indexing using TRUNCATE and crcSalt together fails

lmacneil76
Explorer

Having a hard time getting this right, if (TRUNCATE = 0) or (crcSalt = ) are used by theselfs they work. Does inputs.conf disable the props.conf settings in some way?

------- My setup -------

props.conf this is on the splunk server

[source::C:\\var\\xml\\*]
MAX_EVENTS = 100000
NO_BINARY_CHECK = 1
TRUNCATE = 0
SHOULD_LINEMERGE = true
KV_MODE = xml

inputs.conf this is on my forwarder

[monitor://c:\var\xml\*.xml]
disabled = 0
followTail = 0
crcSalt = <SOURCE>
initCrcLength = 2048
0 Karma
1 Solution

lmacneil76
Explorer

Found my own solution, adding sourcetype and pointing to the props.conf.

**props.conf**
[qtixml]
SHOULD_LINEMERGE = true
MAX_EVENTS = 500000
LINE_BREAKER = </assessmentItem>
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = xml

**inputs.conf** 
[monitor://c:\var\xml\]
disabled = 0
followTail = 0
sourcetype= qtixml
crcSalt = <SOURCE>

View solution in original post

lmacneil76
Explorer

Found my own solution, adding sourcetype and pointing to the props.conf.

**props.conf**
[qtixml]
SHOULD_LINEMERGE = true
MAX_EVENTS = 500000
LINE_BREAKER = </assessmentItem>
NO_BINARY_CHECK = true
TRUNCATE = 0
KV_MODE = xml

**inputs.conf** 
[monitor://c:\var\xml\]
disabled = 0
followTail = 0
sourcetype= qtixml
crcSalt = <SOURCE>
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...