Getting Data In

How to automatically extract fields from XML data (not using the xmlkv command with the 10000 limit)?



I collect "WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" using renderxml=true.
I can extract fields from this data using the command | xmlkv
However, this command only accepts 10000 rows of data, so my goal is to make Splunk do this in the background, and not only for 10000 events.
I have tried tons of combinations in props.conf from and I still have no luck. In my test environment, this props.conf is present on the search head and indexer.

My props.conf

KV_MODE = xml

KV_MODE = xml

[source:WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL]
KV_MODE = xml
0 Karma


KV_MODE should be set on the forwarders

The data pipeline and structured data
For certain types of structured data - data that resides in a file that has headers and fields separated by specific characters - not all components of this pipeline apply. When you collect structured data, you must configure data collection so that it arrives at the indexer in the format that you want. In environments with forwarders, this must happen at the forwarder. See "Extract data from files with headers".

Funny thing is... "extract data from files with headers" doesnt mention XML, but mentions JSON, etc. So maybe I'm wrong here. Please try putting the props on your forwarders and let me know if that works. If it does, we'll ask them to update this article to include xml:

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!