Refine your search:

I've been trying to utilize the linebreaker to break an xml file into multiple Splunk events. I've tried many different ways. I had looked at this example and I'm still having trouble. Here is the Code I believe should work:

Inputs.conf

#########
[monitor:///opt/reports]
source = TRAFFIC
sourcetype = app_log
index = traffic

props.conf

#########
[source::TRAFFIC]
TIME_PREFIX = \<CreationDate\>
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3N
SHOULD_LINEMERGE = false
LINE_BREAKER = \>\s*(?=\<entry\>)
REPORT-xmlext = xml-extr

Below is an excerpt from the xml file I am trying to ingest.

- <response status="success">
- <report name="Top applications" logtype="appstat" start="2011/05/17 00:29:20" end="2011/05/17 01:29:19" generated-at="2011/05/17 01:29:20">
- <entry>
  <risk-of-name>4</risk-of-name> 
  <name>dns</name> 
  <nsess>1197</nsess> 
  <nbytes>336017</nbytes> 
  <nthreats>0</nthreats> 
  </entry>
- <entry>
  <risk-of-name>4</risk-of-name> 
  <name>ssl</name> 
  <nsess>542</nsess> 
  <nbytes>10747761</nbytes> 
  <nthreats>0</nthreats> 
  </entry>
- <entry>
  <risk-of-name>4</risk-of-name> 
  <name>web-browsing</name> 
  <nsess>341</nsess> 
  <nbytes>8085374</nbytes> 
  <nthreats>2</nthreats> 
  </entry>

Thanks for any help!

asked 18 May '11, 07:22

aputz's gravatar image

aputz
1199
accept rate: 0%


One Answer:

Try this:

[source::TRAFFIC]
BREAK_ONLY_BEFORE_DATE = false
BREAK_ONLY_BEFORE = \<entry\>
TIME_PREFIX = generated-at\=\"
REPORT-xmlext = xml-extr

I didn't see the <CreationDate\> tag in the example you gave so this transform is assuming the timestamp comes after "generated-at".

link

answered 18 May '11, 11:45

carmackd's gravatar image

carmackd
5384523
accept rate: 23%

edited 18 May '11, 11:48

Yes, that solved the issue. Thanks for getting me over that hurdle!

(18 May '11, 12:07) aputz
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×148
×57

Asked: 18 May '11, 07:22

Seen: 968 times

Last updated: 18 May '11, 12:07

Copyright © 2005-2012 Splunk Inc. All rights reserved.