Hello everyone,
I have a problem with props.conf.
My props.conf:
[test_cx1]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
KV_MODE = xml
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 99999
MUST_BREAK_AFTER = \</CxXMLResults>
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
description = Checkmarx
disabled = false
pulldown_type = 1
And I have a xml file:
<CxXMLResults ......>
<Query .......>
<Result ........>
</Result>
</Query>
</CxXMLResults>
So I want to a single event contain all CxXMLResults. How can i do this ? What is my wrong ?
As you can see breaks line after each 257 lines. But I set MAX_EVENTS to 99999.
Thanks your answers..
Can you try :
[test_cx1]
DATETIME_CONFIG =
KV_MODE = xml
LINE_BREAKER = \<CxXMLResults\s*
MAX_EVENTS = 99999
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
description = Checkmarx
disabled = false
pulldown_type = 1
Can you try :
[test_cx1]
DATETIME_CONFIG =
KV_MODE = xml
LINE_BREAKER = \<CxXMLResults\s*
MAX_EVENTS = 99999
NO_BINARY_CHECK = true
TRUNCATE = 0
category = Custom
description = Checkmarx
disabled = false
pulldown_type = 1
hi @p_gurav,
I think splunk is having performance problems. Because, I am trying this props.conf:
[test_cx3]
BREAK_ONLY_BEFORE = \<CxXMLResults\s
DATETIME_CONFIG =
LINE_BREAKER = \<CxXMLResults\s
MAX_EVENTS = 1000000
SHOULD_LINEMERGE = true
TRUNCATE = 0
pulldown_type = 1
KV_MODE = xml
NO_BINARY_CHECK = true
category = Custom
disabled = false
EVENT_BREAKER =
MUST_BREAK_AFTER = \</CxXMLResults>
I sent two Report to splunk 562000 lines and 547 lines. When I send 547 lines there is no problem. But When I send 562000 lines report, Splunk break lines randomly 100.000, 46.000, 150.000 e.g
Do you think, what could be the reason ?