Dashboards & Visualizations

Line_breaker separates in un-explained ways

Thuan
Explorer

I have the following xml file all in one single line

For readibility, the file is shown as follows

&ltevent&gt...&lt/event&gt
&ltlabel1&gt ... &lt/label1&gt
&ltlabel2&gt ... &ltlabel2&gt
&ltlabel3&gt ... &lt/label3&gt
...
&ltevent&gt...&lt/event&gt
&ltlabel1&gt ... &lt/label1&gt
&ltlabel2&gt ... &ltlabel2&gt
&ltlabel3&gt ... &lt/label3&gt
...
In order to parse the xml file, my approach is to first break each event to reside on a single line by itself. As follows props.conf only includes the two statements below (no other statement such as timestamps, etc.) to ensure that events are parsed correctly

&#35 To delimit event by event "&ltevent&gt .... &lt/event&gt
&#35 Splunk now knows that each event is on a single line
LINE_BREAKER = (&ltevent)
SHOULD_LINEMERGE = false

However this first step - as configured - fails as event splitting falls on some boundary that I have not been able to explain. This happens whether in data preview mode or search mode. BTW, line breaking happens differently in line mode vs search mode.

Can someone explain what happens and suggest a solution?

Thank you.

0 Karma

sundareshr
Legend

Try escaping the <

LINE_BREAKER = \<event
SHOULD_LINEMERGE = false
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...