https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306918#M93040 <P>We are trying to make a REST input and the result is XML data but it has no schema. The Source we are using is the Palo Alto, specifically Panorama, not the firewalls directly. Can someone help me create an XML schema??? (I have been stuck on this for a while!) Is there a way to manually build a schema in splunk for this input?</P> Fri, 31 Mar 2017 00:50:51 GMT rshoun 2017-03-31T00:50:51Z https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306918#M93040 <P>We are trying to make a REST input and the result is XML data but it has no schema. The Source we are using is the Palo Alto, specifically Panorama, not the firewalls directly. Can someone help me create an XML schema??? (I have been stuck on this for a while!) Is there a way to manually build a schema in splunk for this input?</P> Fri, 31 Mar 2017 00:50:51 GMT https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306918#M93040 rshoun 2017-03-31T00:50:51Z https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306919#M93041 <P>Well, without a sample log it won't be easy to help you. </P> <P>Did you try with : </P> <PRE><CODE>KVMODE = xml </CODE></PRE> Fri, 31 Mar 2017 08:52:40 GMT https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306919#M93041 3no 2017-03-31T08:52:40Z https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306920#M93042 <P>Actually, <CODE>KV_MODE = xml</CODE>.</P> Fri, 31 Mar 2017 21:40:30 GMT https://community.splunk.com/t5/Getting-Data-In/We-are-trying-to-make-a-REST-input-and-the-result-is-XML-data/m-p/306920#M93042 woodcock 2017-03-31T21:40:30Z