reading an xml file in splunk

[a212830]

Hi,

I have an xml file that I am being asked to import into Splunk. How would I configure this?

[martin_mueller]

As any other file - figure out where event breaks and time stamps are, estimate maximum line and byte count per event, and configure that in props.conf - done.

If you need specific help with your format you'll have to post some samples along with what you've tried already.

[a212830]

OK. Thanks.

[martin_mueller]

There's the KV_MODE=xml switch in props.conf, but that's for search time field extraction. First you need to get index-time settings right, and those can differ between XML sources depending on the specific source.

[a212830]

OK. I thought Splunk automatically handled xml with some config settings?