https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57043#M3032 <P>Thanks! We ended up defining an xunit source type which is working nicely- thanks!</P> <P>Yaron</P> Sat, 22 Dec 2012 06:18:38 GMT kretch 2012-12-22T06:18:38Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57041#M3030 <P>Hi There<BR /> I'm very new to splunk, and am trying to find pointers on how to index xunit files (generated from some nose unit tests). A typical xunit file looks like this<BR /> &lt;?xml version="1.0" encoding="UTF-8"?&gt;<BR /> <TESTSUITE name="nosetests" tests="1" errors="1" failures="0" skip="0"><BR /> <TESTCASE classname="path_to_test_suite.TestSomething"><BR /> name="test_it" time="0"&gt;<BR /> <ERROR type="exceptions.TypeError" message="oops, wrong type"><BR /> Traceback (most recent call last):<BR /> ...<BR /> TypeError: oops, wrong type<BR /> </ERROR><BR /> </TESTCASE><BR /> </TESTSUITE></P> <P>How would I go about indexing those files?</P> <P>Thanks<BR /> Yaron</P> Fri, 07 Dec 2012 07:42:37 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57041#M3030 kretch 2012-12-07T07:42:37Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57042#M3031 <P>First, Splunk needs to know very little about a file in order to index it or search it. Basically, if you can point Splunk at the file and the file isn't binary, you are on your way.</P> <P>That said, there are 6 key things that you must configure correctly:</P> <UL> <LI>host (where the data came from)</LI> <LI>source (the name of the file or other type of input)</LI> <LI>sourcetype</LI> <LI>timestamp</LI> <LI>index (where to store the event. By default, it goes into the main index.)</LI> <LI>line-breaking (how to break the input stream into events)</LI> </UL> <P>Most of these are easy, and Splunk usually figures them it all by itself. Source = name of file for your input. Simple. Line-breaking and timestamp extraction are usually defined as part of the sourcetype. If you have a common sourcetype (see the list of <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Listofpretrainedsourcetypes">pretrained sourcetypes</A>), Splunk can even figure out the sourcetype for you.</P> <P>For an XML file though, usually Splunk will need your help. One way to do this is with the Data Preview feature, which is described <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Overviewofdatapreview">here</A></P> <P>Usually, you will need to define a sourcetype for your input, unless one of the <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Listofpretrainedsourcetypes">pretrained sourcetypes</A> works for you. Just think up a name and assign in to the input - maybe <CODE>xunit</CODE>. More info <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Createsourcetypes">here</A>, with links to details on setting the line-breaking and timestamp characteristics for your sourcetype.</P> <P>Finally, here are a few other questions about XML files on the forum:<BR /><BR /> <A href="http://splunk-base.splunk.com/answers/2141/xml-log-source-type">http://splunk-base.splunk.com/answers/2141/xml-log-source-type</A><BR /><BR /> <A href="http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how">http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how</A></P> Sun, 09 Dec 2012 02:48:49 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57042#M3031 lguinn2 2012-12-09T02:48:49Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57043#M3032 <P>Thanks! We ended up defining an xunit source type which is working nicely- thanks!</P> <P>Yaron</P> Sat, 22 Dec 2012 06:18:38 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-use-xunit-files/m-p/57043#M3032 kretch 2012-12-22T06:18:38Z