topic How to extract XML fields combining event? in Getting Data In

How to extract XML fields combining event?

tp92222 — Fri, 27 May 2016 07:09:37 GMT

<?xml version="1.0"?>

-<Customers to="1234" from="1240" time_t="1464236385853">


-<Customer id="1234">

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

<Priority value="1">Medium</Priority>

<Type>Buesiness</Type>

<ID>007-123</ID>

<Title>More store</Title>


-<Contacts>

<Contact>Reference1</Contact>

<Contact>Reference2</Contact>

<Contact>Reference</Contact>

<Contact>Reference</Contact>

</Contacts>

<Summary>Summary of Customer</Summary>

<Analysis>purchase anaysis </Analysis>


<Rating>

<customer rating>3</customer rating>

<Rating>
</Customer>
<Customer id="1235">

similer as above

</Customer>
</Customers>

i modified props.config as following

[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1

probleam is splunk creat 3 events for each customer inforamtion

event one

event two

2013-02-09 20:40:10

event 3
2016-03-23 18:20:06

Medium

Buesiness

007-123

Reference1

Reference2

Reference

Summary of Customer

purchase anaysis

i want one customers info in single event

Re: How to extract XML fields combining event?

tp92222 — Fri, 27 May 2016 07:14:25 GMT

UPDATED
<?xml version="1.0"?>

-<Customers to="1234" from="1240" time_t="1464236385853">


-<Customer id="1234">

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

<Priority value="1">Medium</Priority>

<Type>Buesiness</Type>

<ID>007-123</ID>

<Title>More store</Title>


-<Contacts>

<Contact>Reference1</Contact>

<Contact>Reference2</Contact>

<Contact>Reference</Contact>

<Contact>Reference</Contact>

</Contacts>

<Summary>Summary of Customer</Summary>

<Analysis>purchase anaysis </Analysis>


<Rating>

<customer rating>3</customer rating>

<Rating>
</Customer>
<Customer id="1235">

similer as above

</Customer>
</Customers>

i modified props.config as following

[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1

probleam is splunk creat 3 events for each customer inforamtion

event one

   -<Customers to="1234" from="1240" time_t="1464236385853">


    -<Customer id="1234">

event two

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

event 3

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

    <Priority value="1">Medium</Priority>

    <Type>Buesiness</Type>

    <ID>007-123</ID>

    <Title>More store</Title>


    -<Contacts>

    <Contact>Reference1</Contact>

    <Contact>Reference2</Contact>

    <Contact>Reference</Contact>

    <Contact>Reference</Contact>

    </Contacts>

    <Summary>Summary of Customer</Summary>

    <Analysis>purchase anaysis </Analysis>


    <Rating>

    <customer rating>3</customer rating>

    <Rating>
    </Customer>
    <Customer id="1235">

    similer as above

    </Customer>
    </Customers>

i want one customers info in single event

Re: How to extract XML fields combining event?

jkat54 — Tue, 29 Sep 2020 09:49:19 GMT

FWIW you cant use LINE_BREAKER and MUST_BREAK_AFTER. You'll want to carefully re-read that section of props.conf.spec

Re: How to extract XML fields combining event?

diogofgm — Fri, 27 May 2016 13:25:58 GMT

Can you try this:

[XML]
 DATETIME_CONFIG = CURRENT
 KV_MODE = xml
 LINE_BREAKER = (\<Customers)
 MUST_BREAK_AFTER = \<\/Customers\>
 NO_BINARY_CHECK = 1
 SHOULD_LINEMERGE = false
 TRUNCATE = 0
 pulldown_type = 1

your line breaker has an extra ">" that is not in you data