https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465398#M57183 <P>XMLKV command is more useful in this scenario. it automatically pulls all the xml fields and indexes them.</P> Wed, 01 Apr 2020 15:32:48 GMT p0p00aj 2020-04-01T15:32:48Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465395#M57180 <P>I have data coming in to splunk from a SQL Table and one of the columns in the table has a XML. Is there a way we can parse that XML and extract fields in splunk??</P> <P>The XML is not always the same and keeps changing</P> Wed, 01 Apr 2020 14:47:43 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465395#M57180 p0p00aj 2020-04-01T14:47:43Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465396#M57181 <P>Look into the xpath command: <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath</A></P> Wed, 01 Apr 2020 14:59:13 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465396#M57181 efavreau 2020-04-01T14:59:13Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465397#M57182 <P>Thanks for your message. I see xmlkv more useful for this scenario where the xml fields are automatically pulled.</P> Wed, 01 Apr 2020 15:32:15 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465397#M57182 p0p00aj 2020-04-01T15:32:15Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465398#M57183 <P>XMLKV command is more useful in this scenario. it automatically pulls all the xml fields and indexes them.</P> Wed, 01 Apr 2020 15:32:48 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465398#M57183 p0p00aj 2020-04-01T15:32:48Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465399#M57184 <P>If you can remove the cruft and ensure that the entire raw event is XML, then you can set <CODE>KV_MODE</CODE> to <CODE>xml</CODE> and it will automatically do dynamic field extraction. Short of that, you can do it manually using <CODE>xpath</CODE>:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath</A></P> Wed, 01 Apr 2020 16:00:49 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Parse-an-XML-in-splunk-events/m-p/465399#M57184 woodcock 2020-04-01T16:00:49Z