Getting Data In

Parsing XML log files?

terryloar
Path Finder

Does anyone have experience parsing XML log files? I would like to make the Trizetto Facets XML log output edible by Splunk.

Tags (1)

lguinn2
Legend

Many many people use Splunk to index and parse XML log files. Splunk treats these just like any other text input. You may need to tell Splunk how to break the XML into individual events and how to find the timestamp - usually that's pretty straightforward. Check out these links:

http://splunk-base.splunk.com/answers/52391/xml-input

http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how

Also, if you can post a (sanitized) clip of two or three sample events, the community can probably help you even more.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...