See this for how to update data in Splunk. https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Uploaddata There are bunch of other post on configuration for xml files (for reference, actual configuration will depend upon your xml data) https://answers.splunk.com/answers/187195/how-to-add-and-parse-xml-data-in-splunk.html https://answers.splunk.com/answers/135548/is-possible-to-index-xml.html https://answers.splunk.com/answers/201898/how-to-configure-splunk-to-read-xml-files-correctl.html ... View more