Index XML log files

[SplunkMe]

Hi,

I'm trying out splunk for the first time (4.1.5) as a tool for chewing up audit logs. These logs are written out in XML format but I can't seem to get splunk to recognise them. It's sees .log and .txt extensions but not the xml files. When I look at the directory I'm monitoring I can see the count in splunk ,matches what's on my filesystem, it just doesn't index them.

I'm still looking at the documentation (RTFM) but any help would be appreciated.

Cheers.

[MasterOogway]

I was having a challenging time to get XML indexed from a Windows server but finally got it in using the following:

Inputs.conf

[monitor://D:\data\applog\]
sourcetype = applog_xml
_whitelist = .*\.xml
crcSalt = <SOURCE>

Props.conf

[applog_xml]
MAX_EVENTS = 20000
TIME_PREFIX = \<TimeStamp\>
MAX_TIMESTAMP_LOOKAHEAD = 500

• All my *.xml files lived under D:\data\applog\
• Because the file is sooooo long I needed to extend how many lines the xml could be and successfully index, so I set it HIGH, 20,000
• My time stamp wasn't listed until several hundred characters into the xml file so I went further than I needed to so I was sure to grab it, set it so 500

pstein

[Lowell]

So you are saying that splunk is not indexing these files? In other words, you cannot find them when you search for them? Do your XML files have timestamps? Have you tried searching over "all time"? It may be helpful if you post a sample XML event or two. (Use the "edit" link on your question above. After you paste your event, add 4 spaces to the front of each line to get this site for format your event properly.)