Implement Generic Indexer for XML File With Repeating Key Names

moneybox — Mon, 28 Sep 2020 15:32:02 GMT

Hi,
I'm using splunk for few weeks and its seems really great but recently i had some issue with one of the needs in a new project.

My target is to perform indexing and searching by tag inside XML Files within the following format

value
value
value
xxxxz
ceijciejci

I have no idea what will be the inner fields and how deep will they go.

a success would be for me a way to index everything by key-Value so i could search any of the keys and get all matching object with proper value within them.

my senses tells me i need to write some generic regex for this so thats what i did:

LINE_BREAKER=(<FileItem>.*?/) ### Object Bounderis

REGEX = <(?<_KEY_1>.+?)>(?<_VAL_1>.+?)<\/.+?> ### Generic Key-Value Indexer

its working really nice but there is one issue.
when i have 2 duplicate key with the same name and different value its seems like splunk takes only the first one of them [for example if i search Blabla=xxxxz it wont return any results]

is there any way to do it better and solve my issue?

Thanks.
:)

Re: Implement Generic Indexer for XML File With Repeating Key Names

gkanapathy — Mon, 23 Dec 2013 08:03:17 GMT

You can just add the key

MV_ADD = true

to your transforms extraction. That will turn a field with multiple values into a multi-valued field.

Re: Implement Generic Indexer for XML File With Repeating Key Names

moneybox — Mon, 23 Dec 2013 08:33:14 GMT

Thanks Alot!~!

Re: Implement Generic Indexer for XML File With Repeating Key Names

moneybox — Mon, 23 Dec 2013 08:33:26 GMT

Thanks :)))

topic Implement Generic Indexer for XML File With Repeating Key Names in Getting Data In

Implement Generic Indexer for XML File With Repeating Key Names

I have no idea what will be the inner fields and how deep will they go.

Re: Implement Generic Indexer for XML File With Repeating Key Names

Re: Implement Generic Indexer for XML File With Repeating Key Names

Re: Implement Generic Indexer for XML File With Repeating Key Names