Getting Data In

Index XML log files

SplunkMe
Engager

Hi,

I'm trying out splunk for the first time (4.1.5) as a tool for chewing up audit logs. These logs are written out in XML format but I can't seem to get splunk to recognise them. It's sees .log and .txt extensions but not the xml files. When I look at the directory I'm monitoring I can see the count in splunk ,matches what's on my filesystem, it just doesn't index them.

I'm still looking at the documentation (RTFM) but any help would be appreciated.

Cheers.

Tags (1)

MasterOogway
Communicator

I was having a challenging time to get XML indexed from a Windows server but finally got it in using the following:

Inputs.conf

[monitor://D:\data\applog\]
sourcetype = applog_xml
_whitelist = .*\.xml
crcSalt = <SOURCE>

Props.conf

[applog_xml]
MAX_EVENTS = 20000
TIME_PREFIX = \<TimeStamp\>
MAX_TIMESTAMP_LOOKAHEAD = 500
  • All my *.xml files lived under D:\data\applog\
  • Because the file is sooooo long I needed to extend how many lines the xml could be and successfully index, so I set it HIGH, 20,000
  • My time stamp wasn't listed until several hundred characters into the xml file so I went further than I needed to so I was sure to grab it, set it so 500

pstein

Lowell
Super Champion

So you are saying that splunk is not indexing these files? In other words, you cannot find them when you search for them? Do your XML files have timestamps? Have you tried searching over "all time"? It may be helpful if you post a sample XML event or two. (Use the "edit" link on your question above. After you paste your event, add 4 spaces to the front of each line to get this site for format your event properly.)

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...