topic Re: How to index XML data in Splunk without row. prefix? in Getting Data In

How to index XML data in Splunk without row. prefix?

slopez100 — Fri, 26 Sep 2014 16:29:28 GMT

My XML is as follows:

<row>
    <Id>1</Id>
    <PostId>7</PostId>
    <UserId>2</UserId>
    <VoteTypeId>2</VoteTypeId>
    <CreationDate>2009-11-06T02:22:37.063</CreationDate>
    <TargetUserId>7</TargetUserId>
    <TargetRepChange>10</TargetRepChange>
    <IPAddress>64.127.105.60</IPAddress>
</row>
<row>
    <Id>2</Id>
    <PostId>6</PostId>
    <UserId>2</UserId>
    <VoteTypeId>2</VoteTypeId>
    <CreationDate>2009-11-06T02:22:38.25</CreationDate>
    <TargetUserId>31</TargetUserId>
    <TargetRepChange>10</TargetRepChange>
    <IPAddress>64.127.105.61</IPAddress>
</row>

Splunk labels the columns as row.id, row.IPAddress, etc.

Is there a way to have the fields indexed in splunk without the "row." prefix. I've looked at FIELDALIAS and some other items but they don't do what I'm seeking.

Any help will be greatly appreciated.

Thanks in advance.

Scott

Re: How to index XML data in Splunk without row. prefix?

somesoni2 — Wed, 01 Oct 2014 02:30:00 GMT

Give this a try (props.conf)

[yoursourcetype]
BREAK_ONLY_BEFORE=<Id>
CHARSET=AUTO
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SEDCMD-acrRemover=s/\x0D//g
SEDCMD-aremove=s/\<row\>//g
SEDCMD-blfRemover=s/\x0A//g
SEDCMD-bremove=s/\<\/row\>//g
SEDCMD-cRemove=s/\<\/\w+\>//g
SEDCMD-dRemove=s/\</" /g
SEDCMD-eRemove=s/\>/="/g
SEDCMD-fRemove=s/^"//g
SHOULD_LINEMERGE=true

Re: How to index XML data in Splunk without row. prefix?

trsavela — Thu, 09 Oct 2014 01:32:54 GMT

Try this:

| rename  "row."* as *