Transforming special characters in XML

jedatt01 — Mon, 30 Jun 2014 19:03:55 GMT

I have an XML based source that has special characters defined. See below

&   &amp;   
<   &lt;    
>   &gt;    
"   &quot;  
'   &apos;

Does anyone know how to use transforms.conf to convert these to the real characters in the left column at index time?

Re: Transforming special characters in XML

somesoni2 — Mon, 30 Jun 2014 19:34:24 GMT

Add this in your sourcetype definition (props.conf)

[yoursourcetype]
...
..other configs..
...
SEDCMD-specialchars1 = s/specialcodeInxml/replacementcode/g

You need to add one entry for each special character replacement.
e.g.

  for &
        SEDCMD-specialchars5 = s/&amp;/\&/g
  for others
        SEDCMD-specialchars3 = s/&quot;/"/g
        SEDCMD-specialchars4 = s/&apos;/'/g

For more details see this documentation-
http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Anonymizedatausingconfigurationfiles

search for "Anonymize data through a sed script"

topic Transforming special characters in XML in Getting Data In

Transforming special characters in XML

Re: Transforming special characters in XML