https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-log-files/m-p/76125#M15547 <P>Many many people use Splunk to index and parse XML log files. Splunk treats these just like any other text input. You may need to tell Splunk how to break the XML into individual events and how to find the timestamp - usually that's pretty straightforward. Check out these links:</P> <P><A href="http://splunk-base.splunk.com/answers/52391/xml-input">http://splunk-base.splunk.com/answers/52391/xml-input</A><BR /><BR /> <A href="http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how">http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how</A></P> <P>Also, if you can post a (sanitized) clip of two or three sample events, the community can probably help you even more.</P> Thu, 03 Jan 2013 03:28:38 GMT lguinn2 2013-01-03T03:28:38Z https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-log-files/m-p/76124#M15546 <P>Does anyone have experience parsing XML log files? I would like to make the Trizetto Facets XML log output edible by Splunk. </P> Wed, 02 Jan 2013 22:40:38 GMT https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-log-files/m-p/76124#M15546 terryloar 2013-01-02T22:40:38Z https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-log-files/m-p/76125#M15547 <P>Many many people use Splunk to index and parse XML log files. Splunk treats these just like any other text input. You may need to tell Splunk how to break the XML into individual events and how to find the timestamp - usually that's pretty straightforward. Check out these links:</P> <P><A href="http://splunk-base.splunk.com/answers/52391/xml-input">http://splunk-base.splunk.com/answers/52391/xml-input</A><BR /><BR /> <A href="http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how">http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how</A></P> <P>Also, if you can post a (sanitized) clip of two or three sample events, the community can probably help you even more.</P> Thu, 03 Jan 2013 03:28:38 GMT https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-log-files/m-p/76125#M15547 lguinn2 2013-01-03T03:28:38Z