https://community.splunk.com/t5/Getting-Data-In/Questions-on-indexing-xml-data/m-p/423173#M74332 <P>I've few questions regarding indexing xml data onto Splunk.<BR /> 1. The log file is a combination of normal text data and xml based on the log level(debug/info). Can i use the setting kvmode=xml for such a log file?Will it get indexed correctly with xml fields identified?</P> <OL> <LI>Does kvmode=xml setting improves search performance, when we need to report out of few(may be 3 or 4) xml tag values? Without this setting, it would be regex and i'm trying to understand which is better?</LI> </OL> <P>3.What should be the line breaker setting if there are multiple date values in xml .</P> Wed, 30 May 2018 02:01:09 GMT meenu_2017 2018-05-30T02:01:09Z https://community.splunk.com/t5/Getting-Data-In/Questions-on-indexing-xml-data/m-p/423173#M74332 <P>I've few questions regarding indexing xml data onto Splunk.<BR /> 1. The log file is a combination of normal text data and xml based on the log level(debug/info). Can i use the setting kvmode=xml for such a log file?Will it get indexed correctly with xml fields identified?</P> <OL> <LI>Does kvmode=xml setting improves search performance, when we need to report out of few(may be 3 or 4) xml tag values? Without this setting, it would be regex and i'm trying to understand which is better?</LI> </OL> <P>3.What should be the line breaker setting if there are multiple date values in xml .</P> Wed, 30 May 2018 02:01:09 GMT https://community.splunk.com/t5/Getting-Data-In/Questions-on-indexing-xml-data/m-p/423173#M74332 meenu_2017 2018-05-30T02:01:09Z