Getting Data In

Why is line breaking not working as expected for my XML data when I edit .conf files directly?

gagi76
New Member

Hi everyone,

Can someone please explain why these steps won't work? XML file that I input in Splunk are one event, like this:
alt text

inputs.conf

[monitor://c:/to_the_file]
Sourcetype = aaa

props.conf

[aaa]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)

I have tried this from Splunk Web (upload file and configured SHOULD_LINEMERGE = false and
LINE_BREAKER = ([\r\n]*)) and it worked, but when I do it from .conf files, it won't. Any ideas?
And of course, how can I configure date and time to be recognized from Splunk?

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

props.conf

[aaa]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=\<LOG\>)
TIME_PREFIX = DATE\>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

props.conf

[aaa]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]*)(?=\<LOG\>)
TIME_PREFIX = DATE\>
TIME_FORMAT = %Y%m%d</DATE><TIME>%H%M%S
MAX_TIMESTAMP_LOOKAHEAD = 27
0 Karma

gagi76
New Member

Thanks for helping,

ok, we broke logs now with those lines, but the date and time are not recognized from splunk. I have read that I should make datetime.xml file a configure it along with props.conf?

0 Karma

gagi76
New Member

misspell :
LINE_BREAKER = ([\r\n]*)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...