How to add and parse XML data in Splunk?

gitingua — Tue, 01 Feb 2022 10:29:40 GMT

how parsing xml data ?

<v8e:Event>

<v8e:Level>Information</v8e:Level>

<v8e:Date>2022-01-26T16:20:24</v8e:Date>

<v8e:ApplicationName>Job</v8e:ApplicationName>

<v8e:ApplicationPresentation>Фоновое</v8e:ApplicationPresentation>

<v8e:Event>Finish</v8e:Event>

<v8e:EventPresentation>Сеанс</v8e:EventPresentation>

<v8e:User>Jong Wik</v8e:User>

<v8e:UserName>Корот</v8e:UserName>

<v8e:Computer>srv-2-srv</v8e:Computer>

<v8e:Metadata/>

<v8e:MetadataPresentation/>

<v8e:Comment/>

<v8e:Data xsi:nil="true"/>

<v8e:DataPresentation/>

<v8e:TransactionStatus>NotApplicable</v8e:TransactionStatus>

<v8e:TransactionID/>

<v8e:Connection>0</v8e:Connection>

<v8e:Session>5146</v8e:Session>

<v8e:ServerName/>

<v8e:Port>0</v8e:Port>

<v8e:SyncPort>0</v8e:SyncPort>

</v8e:Event>

Re: How to add and parse XML data in Splunk?

ITWhisperer — Tue, 01 Feb 2022 10:45:45 GMT

spath will extract the fields from the events

| spath