How to configure props.conf to extract fields and line break multiple XML files?

[andyhine]

Hi

I'm new to splunk. I'm trying to index multiple XML files that look like:

<?xml version="1.0" encoding="UTF-8"?>
<!-- produced for the bleb.org TV system at Sat Aug 2 08:39:23 2014 -->
<channel id="4music" source="XMLTV" date="02/08/2014">
<programme>
<desc>Teleshopping</desc>
<title>Teleshopping</title>
<end>0700</end>
<start>0600</start>
</programme>
<programme>
<desc>Teleshopping</desc>
<title>Teleshopping</title>
<end>0730</end>
<start>0700</start>
</programme>
...
</channel>

I've added the data input as files and directories and set the source time to be manual with the name "schedule". I'm not getting correct search results so I've tried various things in props.conf but I just can't get the correct results.

Is anyone able to guide me what I need to put in props.conf (and do I need anything in transforms.conf?)

Thanks

[strive]

Check these

http://answers.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how
http://answers.splunk.com/answers/24573/problems-implementing-linebreaker-to-ingest-xml
http://answers.splunk.com/answers/88201/need-help-with-event-breaking-in-xml-log-file

There are already many related questions. Check the Related questions section on the page.

[somesoni2]

Can you share the props.conf/transforms.conf that you tried?

[andyhine]

Hi. Many thanks. Tried all of those but still not working correctly in my case.