above link doesn't work , kindly help me to print my xml in pretty print format ... View more

I'm using translatefix too. To set your expectations: In my experience, the translated fields are not subsequently extracted and indexed. For example, I can search "MsgType=Execution" as a string, but I can't search "MsgType!=Heartbeat" because it's not extracted as a key/value pair. I discussed it with a Splunk Sales Engineer, he had a trick to dump the translated fields back into the raw index (?) but I've lost the notes I took that day (arrrgh!).. I've not had the time or talent to revisit the problem, but I would be grateful for anybody who could. ... View more

This was very useful - many thanks ... View more

Many thanks - I didn't really need the whitelist as you pointed out ... View more

There are many ways to mess up the configuration. Does the data get the correct sourcetype in the inputs.conf on the forwarder? Is the sourcetype fully defined in props.conf on the indexer? To ease debugging, do post both configuration extracts. ... View more

A found this was due to a lack of understanding of the front end GUI - the data was being consumed as required. ... View more

Just insert this line inside your props sourcetype section: DATETIME_CONFIG = CURRENT ... View more

I was unaware of two different tar files - one for forwarder and one for GUI ... View more