How do I parse this XML output into Splunk?
Currently Splunk treats the whole chunk as a block. Here is my props.conf:
[ciscofaults]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER =
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1
↧