Hi,
I have an xml file that I am being asked to import into Splunk. How would I configure this?
As any other file - figure out where event breaks and time stamps are, estimate maximum line and byte count per event, and configure that in props.conf - done.
If you need specific help with your format you'll have to post some samples along with what you've tried already.
OK. Thanks.
There's the KV_MODE=xml
switch in props.conf, but that's for search time field extraction. First you need to get index-time settings right, and those can differ between XML sources depending on the specific source.
OK. I thought Splunk automatically handled xml with some config settings?