How to automatically extract fields from XML data (not using the xmlkv command with the 10000 limit)?

[bravon]

Hi,

I collect "WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL" using renderxml=true.
I can extract fields from this data using the command | xmlkv
However, this command only accepts 10000 rows of data, so my goal is to make Splunk do this in the background, and not only for 10000 events.
I have tried tons of combinations in props.conf from https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html and I still have no luck. In my test environment, this props.conf is present on the search head and indexer.

My props.conf

[xmlWinEventLog:*]
KV_MODE = xml

[WinEventLog:*]
KV_MODE = xml

[source:WinEventLog:Microsoft-Windows-AppLocker/EXE and DLL]
KV_MODE = xml

[jkat54]

KV_MODE should be set on the forwarders

http://docs.splunk.com/Documentation/Splunk/6.2.0/Deploy/Datapipeline

The data pipeline and structured data
For certain types of structured data - data that resides in a file that has headers and fields separated by specific characters - not all components of this pipeline apply. When you collect structured data, you must configure data collection so that it arrives at the indexer in the format that you want. In environments with forwarders, this must happen at the forwarder. See "Extract data from files with headers".

Funny thing is... "extract data from files with headers" doesnt mention XML, but mentions JSON, etc. So maybe I'm wrong here. Please try putting the props on your forwarders and let me know if that works. If it does, we'll ask them to update this article to include xml: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Extractfieldsfromfileheadersatindextime