2 approaches define your event breaking rules at indextime for your sourcetype to break that xml into several small events. but then all the other fields will be disconnected from the events. https://docs.splunk.com/Documentation/Splunk/latest/Data/Configureeventlinebreaking or index at it is, and at search time, try to use the | spath command to parse the xml and get the fields stored in a multivalue field structure. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath ... View more