https://community.splunk.com/t5/All-Apps-and-Add-ons/CHECK-MODE-xml-doesn-t-work/m-p/43016#M2153 <P>Hello,</P> <P>When i indexed a XML file in local machine (Splunk version 5) with option CHECK_MODE=xml for sourtype "test_XML" , i saw clearly the fields that Splunk extracted, in the left hand, have the formats such as: table{@id} , table.content{@text} ...</P> <P>But if i use splunk Universal Forwarder to forward that file to indexer (both have version 4.3.4), with CHECK_MODE=xml for that sourcetype, what i got in the left hand were : id, text... and i couldn't get any new field even using spath too. Can you tell me what is the problem ?</P> <P>The file is just one-lien long xml format.</P> Mon, 28 Sep 2020 12:51:17 GMT sieutruc 2020-09-28T12:51:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/CHECK-MODE-xml-doesn-t-work/m-p/43016#M2153 <P>Hello,</P> <P>When i indexed a XML file in local machine (Splunk version 5) with option CHECK_MODE=xml for sourtype "test_XML" , i saw clearly the fields that Splunk extracted, in the left hand, have the formats such as: table{@id} , table.content{@text} ...</P> <P>But if i use splunk Universal Forwarder to forward that file to indexer (both have version 4.3.4), with CHECK_MODE=xml for that sourcetype, what i got in the left hand were : id, text... and i couldn't get any new field even using spath too. Can you tell me what is the problem ?</P> <P>The file is just one-lien long xml format.</P> Mon, 28 Sep 2020 12:51:17 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/CHECK-MODE-xml-doesn-t-work/m-p/43016#M2153 sieutruc 2020-09-28T12:51:17Z https://community.splunk.com/t5/All-Apps-and-Add-ons/CHECK-MODE-xml-doesn-t-work/m-p/43017#M2154 <P>i don't know whether it's totally correct, when i upgrade all Splunk instances in my system \ to Version 5, all would be solved.</P> Mon, 26 Nov 2012 22:52:32 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/CHECK-MODE-xml-doesn-t-work/m-p/43017#M2154 sieutruc 2012-11-26T22:52:32Z