i'm try to collect oracle 12c audit log in XML format on windows server.
i have created this monitor in oracle server and (for test in splunk server and another w12 server)
[monitor://C:\OracleLogs\Audit\*.xml]
sourcetype = oracle:audit:xml
crcSalt =
index = xx.oracle
i have configured this props.conf in Splunk server:
[oracle:audit:xml]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX=
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N
KV_MODE = None
If i put an XML log file in the monitored folder onto splunk server or the other test server the collection works fine and the event are splitted correctly
but if i put the same xml file in the oracle server the collected event are splitted line by line (i think), only in oracle server.
the universal forwarders are the same version.
this is an example of log file:
11.2464104012017-10-18T20:00:21.233000ZSYSW2K8-ORACLE1516:3004W2K8-ORACLE000NONE1483776131select /*+ no_parallel(t) no_parallel_index(t) dbms_stats cursor_sharing_exact use_weak_name_resl dynamic_sampling(0) no_monitoring xmlindex_sel_idx_tbl no_substrb_pad */ substrb(dump("STARTUP_TIME",16,0,64),1,240) val,
rowidtochar(rowid) rwid from "SYS"."WRM$_PDB_INSTANCE" t where rowid in (chartorowid('AAACIEAADAAACCMAAA'),chartorowid('AAACIEAADAAACCNAAB')) order by "STARTUP_TIME"464104022017-10-18T20:00:21.264000ZSYSW2K8-ORACLE1516:3004W2K8-ORACLE000NONE1483776131select /*+ no_parallel(t) no_parallel_index(t) dbms_stats cursor_sharing_exact use_weak_name_resl dynamic_sampling(0) no_monitoring xmlindex_sel_idx_tbl no_substrb_pad */ substrb(dump("STARTUP_TIME",16,0,64),1,240) val,
rowidtochar(rowid) rwid from "SYS"."WRM$_PDB_INSTANCE" t where rowid in (chartorowid('AAACIEAADAAACCMAAA'),chartorowid('AAACIEAADAAACCNAAB')) order by "STARTUP_TIME"464104032017-10-18T20:00:24.772000ZSYSW2K8-ORACLE1516:3004W2K8-ORACLE000NONE1483776131select /*+ no_parallel(t) no_parallel_index(t) dbms_stats cursor_sharing_exact use_weak_name_resl dynamic_sampling(0) no_monitoring xmlindex_sel_idx_tbl no_substrb_pad */ substrb(dump("STARTUP_TIME",16,0,64),1,240) val,
rowidtochar(rowid) rwid from "SYS"."WRM$_DATABASE_INSTANCE" t where rowid in (chartorowid('AAACH0AADAAACALAAA'),chartorowid('AAACH0AADAAACALAAB'),chartorowid('AAACH0AADAAACALAAC')) order by "STARTUP_TIME"
Why i have two different situation with the same configuration?
Thanks at all