First, Splunk needs to know very little about a file in order to index it or search it. Basically, if you can point Splunk at the file and the file isn't binary, you are on your way.
That said, there are 6 key things that you must configure correctly:
- host (where the data came from)
- source (the name of the file or other type of input)
- sourcetype
- timestamp
- index (where to store the event. By default, it goes into the main index.)
- line-breaking (how to break the input stream into events)
Most of these are easy, and Splunk usually figures them it all by itself. Source = name of file for your input. Simple. Line-breaking and timestamp extraction are usually defined as part of the sourcetype. If you have a common sourcetype (see the list of pretrained sourcetypes), Splunk can even figure out the sourcetype for you.
For an XML file though, usually Splunk will need your help. One way to do this is with the Data Preview feature, which is described here
Usually, you will need to define a sourcetype for your input, unless one of the pretrained sourcetypes works for you. Just think up a name and assign in to the input - maybe xunit. More info here, with links to details on setting the line-breaking and timestamp characteristics for your sourcetype.
Finally, here are a few other questions about XML files on the forum:
http://splunk-base.splunk.com/answers/2141/xml-log-source-type
http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how
