I've few questions regarding indexing xml data onto Splunk.
1. The log file is a combination of normal text data and xml based on the log level(debug/info). Can i use the setting kvmode=xml for such a log file?Will it get indexed correctly with xml fields identified?
- Does kvmode=xml setting improves search performance, when we need to report out of few(may be 3 or 4) xml tag values? Without this setting, it would be regex and i'm trying to understand which is better?
3.What should be the line breaker setting if there are multiple date values in xml .
