I'm new to splunk. I'm trying to index multiple XML files that look like:
<?xml version="1.0" encoding="UTF-8"?>
<!-- produced for the bleb.org TV system at Sat Aug 2 08:39:23 2014 -->
<channel id="4music" source="XMLTV" date="02/08/2014">
I've added the data input as files and directories and set the source time to be manual with the name "schedule". I'm not getting correct search results so I've tried various things in props.conf but I just can't get the correct results.
Is anyone able to guide me what I need to put in props.conf (and do I need anything in transforms.conf?)
There are already many related questions. Check the Related questions section on the page.