<?xml version="1.0"?>
-<Customers to="1234" from="1240" time_t="1464236385853">
-<Customer id="1234">
<Created time_t="1455050410000">2013-02-09 20:40:10</Created>
<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>
<Priority value="1">Medium</Priority>
<Type>Buesiness</Type>
<ID>007-123</ID>
<Title>More store</Title>
-<Contacts>
<Contact>Reference1</Contact>
<Contact>Reference2</Contact>
<Contact>Reference</Contact>
<Contact>Reference</Contact>
</Contacts>
<Summary>Summary of Customer</Summary>
<Analysis>purchase anaysis </Analysis>
<Rating>
<customer rating>3</customer rating>
<Rating>
</Customer>
<Customer id="1235">
similer as above
</Customer>
</Customers>
i modified props.config as following
[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1
probleam is splunk creat 3 events for each customer inforamtion
event one
event two
2013-02-09 20:40:10
event 3
2016-03-23 18:20:06
Medium
Buesiness
007-123
-
Reference1
Reference2
Reference
Reference
Summary of Customer
purchase anaysis
3
i want one customers info in single event
Can you try this:
[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (\<Customers)
MUST_BREAK_AFTER = \<\/Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1
your line breaker has an extra ">" that is not in you data
UPDATED
<?xml version="1.0"?>
-<Customers to="1234" from="1240" time_t="1464236385853">
-<Customer id="1234">
<Created time_t="1455050410000">2013-02-09 20:40:10</Created>
<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>
<Priority value="1">Medium</Priority>
<Type>Buesiness</Type>
<ID>007-123</ID>
<Title>More store</Title>
-<Contacts>
<Contact>Reference1</Contact>
<Contact>Reference2</Contact>
<Contact>Reference</Contact>
<Contact>Reference</Contact>
</Contacts>
<Summary>Summary of Customer</Summary>
<Analysis>purchase anaysis </Analysis>
<Rating>
<customer rating>3</customer rating>
<Rating>
</Customer>
<Customer id="1235">
similer as above
</Customer>
</Customers>
i modified props.config as following
[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1
probleam is splunk creat 3 events for each customer inforamtion
event one
-<Customers to="1234" from="1240" time_t="1464236385853">
-<Customer id="1234">
event two
<Created time_t="1455050410000">2013-02-09 20:40:10</Created>
event 3
<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>
<Priority value="1">Medium</Priority>
<Type>Buesiness</Type>
<ID>007-123</ID>
<Title>More store</Title>
-<Contacts>
<Contact>Reference1</Contact>
<Contact>Reference2</Contact>
<Contact>Reference</Contact>
<Contact>Reference</Contact>
</Contacts>
<Summary>Summary of Customer</Summary>
<Analysis>purchase anaysis </Analysis>
<Rating>
<customer rating>3</customer rating>
<Rating>
</Customer>
<Customer id="1235">
similer as above
</Customer>
</Customers>
i want one customers info in single event
FWIW you cant use LINE_BREAKER and MUST_BREAK_AFTER. You'll want to carefully re-read that section of props.conf.spec