Hi,
I was working with Splunk and XML data from past 1 month, and found that Splunk is not very friendly with XML as compared to logs.
Can anyone help me out that is it really a good suggestion to use Splunk with XML data source.
Thanks in advance!
You can also use the xmlkv
command to extract the fields from xml.
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Xmlkv
You need the xpath
command!
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Xpath
I have used xpath and spath, I wans able to generate some of the reports but it looks like Splunk is actually not meant for structured xml data.