https://community.splunk.com/t5/Splunk-Search/KV-MODE-xml-not-working-but-xmlkv-is/m-p/467978#M131753 <P><CODE>KV_MODE</CODE> is search time attribute. This doesn't work in indexers. You need to add it in props.conf in search head(s).</P> <PRE><CODE>KV_MODE = [none|auto|auto_escaped|multi|json|xml] * Used for search-time field extractions only. * Specifies the field/value extraction mode for the data. </CODE></PRE> Wed, 08 Apr 2020 05:16:32 GMT manjunathmeti 2020-04-08T05:16:32Z https://community.splunk.com/t5/Splunk-Search/KV-MODE-xml-not-working-but-xmlkv-is/m-p/467977#M131752 <P>I have an app on a deployment server that takes in XML data, this app includes a props.conf with KV_MODE=xml. <BR /> When I see the data in Splunk, no XML fields are being extracted, but when I add | xmlkv to the end of my query, it extracts all XML fields. Since KV_MODE is for search time extractions does that mean that I have to also put this props.conf on the SHC? Or is there another reason why it's not working? </P> <P>Thanks in advance.</P> Wed, 30 Sep 2020 04:53:37 GMT https://community.splunk.com/t5/Splunk-Search/KV-MODE-xml-not-working-but-xmlkv-is/m-p/467977#M131752 willcwhite 2020-09-30T04:53:37Z https://community.splunk.com/t5/Splunk-Search/KV-MODE-xml-not-working-but-xmlkv-is/m-p/467978#M131753 <P><CODE>KV_MODE</CODE> is search time attribute. This doesn't work in indexers. You need to add it in props.conf in search head(s).</P> <PRE><CODE>KV_MODE = [none|auto|auto_escaped|multi|json|xml] * Used for search-time field extractions only. * Specifies the field/value extraction mode for the data. </CODE></PRE> Wed, 08 Apr 2020 05:16:32 GMT https://community.splunk.com/t5/Splunk-Search/KV-MODE-xml-not-working-but-xmlkv-is/m-p/467978#M131753 manjunathmeti 2020-04-08T05:16:32Z