Splunk Search

How to configure props.conf to extract fields and line break multiple XML files?

New Member

Hi

I'm new to splunk. I'm trying to index multiple XML files that look like:

<?xml version="1.0" encoding="UTF-8"?>
<!-- produced for the bleb.org TV system at Sat Aug 2 08:39:23 2014 -->
<channel id="4music" source="XMLTV" date="02/08/2014">
<programme>
<desc>Teleshopping</desc>
<title>Teleshopping</title>
<end>0700</end>
<start>0600</start>
</programme>
<programme>
<desc>Teleshopping</desc>
<title>Teleshopping</title>
<end>0730</end>
<start>0700</start>
</programme>
...
</channel>

I've added the data input as files and directories and set the source time to be manual with the name "schedule". I'm not getting correct search results so I've tried various things in props.conf but I just can't get the correct results.

Is anyone able to guide me what I need to put in props.conf (and do I need anything in transforms.conf?)

Thanks

0 Karma

Influencer
0 Karma

SplunkTrust
SplunkTrust

Can you share the props.conf/transforms.conf that you tried?

0 Karma

New Member

Hi. Many thanks. Tried all of those but still not working correctly in my case.

0 Karma