I got a problem getting splunk to read my XML files correctly. Example on one of my XML files: http://imgur.com/RTlYiLy I want splunk to create a event for every row(the element) and every event should contain information on which table it's from. I've tried to do this in some different ways but none seem to affect splunk. My latest attempt was to edit props.conf: [xml-too_small] DATETIME_CONFIG = CURRENT KV_MODE = xml SHOULD_LINEMERGE = True BREAK_ONLY_BEFORE = row(surrounded with <>)// Had problems writing html tags MUST_BREAK_AFTER = table(surrounded with <>) | /row(surrounded with <>) TRUNCATE = 0 FIELDALIAS-rootfields = table{@name} as Table table.row{@name} as Row table.row.value{@name} as Valuename table.row.value as Value and to add queue = parsingQueue in inputs.conf. Thank you! Darlynna ... View more