Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time]

dfofie — Tue, 02 Jul 2019 15:01:16 GMT

Hello,
I have the following XML file containing many Objects elements.

<?xml version='1.0' encoding='UTF-8'?>
<Module name='ModuleName' ModuleAttributeName='/Path/To/ModuleName'>
    <ModuleAttribute name='IN_Scope' value='Project'/>
    <ModuleAttribute name='IN_Type' value='TRP'/>
    <ModuleAttribute name='IN_Feature' value='SYS'/>
    <ModuleAttribute name='IN_Area' value='SYSTEM'/>
    <ModuleAttribute name='ModuleType' value='TRP'/>
<Object id='11' MUID='MUID.11' GUID='110023er.11' >
    <Attribute name='State' value='ok'/>
    <Attribute name='evaluated' value='no'/>
    <Attribute name='original ASIL-Classification' value='---'/>
    <Attribute name='Source_CQ_ID' value=''/>
</Object>
<Object id='12' MUID='MUID.12' GUID='110023er.12' >
    <Attribute name='State' value='ok'/>
    <Attribute name='evaluated' value='no'/>
    <Attribute name='original ASIL-Classification' value='---'/>
    <Attribute name='Source_CQ_ID' value=''/>
</Object></Module>

I have liked to have the following structure:

Object
    - ModuleName: ModuleAttributeName
    - ModuleFullName: /Path/To/ModuleName
    - ModuleIN_Scope: Project
    - ModuleIN_Feature: TRP
    - ModuleAttributeWhatever: ...
    - ObjectState: ok
    - ObjectEvaluated: no
    - ObjectSource_CQ_ID: ''

How can I easily parse this in splunk ? The Module Tag appeas

Re: Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time]

Sukisen1981 — Wed, 03 Jul 2019 07:03:36 GMT

are you looking for index time or search time extraction?

Re: Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time]

dfofie — Wed, 03 Jul 2019 07:12:35 GMT

Hello @sukissen, I'm mostly looking for the index time extraction.

topic Re: Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time] in Security

Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time]

Re: Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time]

Re: Field Extraction from XML multiple Tag Elements [In Splunk Web - Index Time]