topic reading an xml file in splunk in Getting Data In

reading an xml file in splunk

a212830 — Wed, 23 Jul 2014 15:33:57 GMT

Hi,

I have an xml file that I am being asked to import into Splunk. How would I configure this?

Re: reading an xml file in splunk

martin_mueller — Wed, 23 Jul 2014 18:38:00 GMT

As any other file - figure out where event breaks and time stamps are, estimate maximum line and byte count per event, and configure that in props.conf - done.

If you need specific help with your format you'll have to post some samples along with what you've tried already.

Re: reading an xml file in splunk

a212830 — Wed, 23 Jul 2014 20:12:44 GMT

OK. I thought Splunk automatically handled xml with some config settings?

Re: reading an xml file in splunk

martin_mueller — Wed, 23 Jul 2014 20:17:54 GMT

There's the KV_MODE=xml switch in props.conf, but that's for search time field extraction. First you need to get index-time settings right, and those can differ between XML sources depending on the specific source.

Re: reading an xml file in splunk

a212830 — Wed, 23 Jul 2014 21:33:20 GMT

OK. Thanks.