Parsing XML log files?

[terryloar]

Does anyone have experience parsing XML log files? I would like to make the Trizetto Facets XML log output edible by Splunk.

[lguinn2]

Many many people use Splunk to index and parse XML log files. Splunk treats these just like any other text input. You may need to tell Splunk how to break the XML into individual events and how to find the timestamp - usually that's pretty straightforward. Check out these links:

http://splunk-base.splunk.com/answers/52391/xml-input

http://splunk-base.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how

Also, if you can post a (sanitized) clip of two or three sample events, the community can probably help you even more.