topic How to automatically extract fields from XML data (not using the xmlkv command with the 10000 limit)? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-automatically-extract-fields-from-XML-data-not-using-the/m-p/258165#M49600 <P>Hi, </P> <P>I collect "WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" using <CODE>renderxml=true</CODE>.<BR /> I can extract fields from this data using the command <CODE>| xmlkv</CODE><BR /> However, this command only accepts 10000 rows of data, so my goal is to make Splunk do this in the background, and not only for 10000 events. <BR /> I have tried tons of combinations in props.conf from <A href="https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html">https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html</A> and I still have no luck. In my test environment, this props.conf is present on the search head and indexer.</P> <P>My props.conf</P> <PRE><CODE>[xmlWinEventLog:*] KV_MODE = xml [WinEventLog:*] KV_MODE = xml [source:WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL] KV_MODE = xml </CODE></PRE> Thu, 19 May 2016 09:18:07 GMT bravon 2016-05-19T09:18:07Z How to automatically extract fields from XML data (not using the xmlkv command with the 10000 limit)? https://community.splunk.com/t5/Getting-Data-In/How-to-automatically-extract-fields-from-XML-data-not-using-the/m-p/258165#M49600 <P>Hi, </P> <P>I collect "WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" using <CODE>renderxml=true</CODE>.<BR /> I can extract fields from this data using the command <CODE>| xmlkv</CODE><BR /> However, this command only accepts 10000 rows of data, so my goal is to make Splunk do this in the background, and not only for 10000 events. <BR /> I have tried tons of combinations in props.conf from <A href="https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html">https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html</A> and I still have no luck. In my test environment, this props.conf is present on the search head and indexer.</P> <P>My props.conf</P> <PRE><CODE>[xmlWinEventLog:*] KV_MODE = xml [WinEventLog:*] KV_MODE = xml [source:WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL] KV_MODE = xml </CODE></PRE> Thu, 19 May 2016 09:18:07 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-automatically-extract-fields-from-XML-data-not-using-the/m-p/258165#M49600 bravon 2016-05-19T09:18:07Z