Parsing XML log files

monteirolopes — Wed, 03 May 2017 20:58:12 GMT

Hi,

I would to like to index a log in xml format and I would to like to parse it so that the content of each event was what was inside the tags, as shown below:

Event1 = content 1
Event2 = content 2

How can I do this? Is there a regular expression for the above example?

Best regards,
Lopes.

Re: Parsing XML log files

niketn — Thu, 04 May 2017 03:48:21 GMT

@monteirolopes... depends on how you are loading XML data. Is the entire content itself XML or is XML part of content with some additional text without XML format.

For raw XML event
Based on whether you want to have Splunk perform automatic XML extraction during index time or search time you can choose between either one of INDEXED_EXTRACTIONS or KV_MODE as XML. Refer to the following documentation: http://docs.splunk.com/Documentation/Splunk/latest/Data/Extractfieldsfromfileswithstructureddata#Props.conf_attributes_for_structured_data

For XML data as a subset of raw event
You can use spath to traverse XML once you have extracted XML Data.

Please find below run anywhere search for your mock data. Also refer to spath documentation: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

| makeresults
| eval mockXMLData="<Flow_data>Content1</Flow_data><Detected_signatures>Content2</Detected_signatures>"
| spath input=mockXMLData path=Detected_signatures output=key
| table key mockXMLData

PS: You can apply regular expression using rex, command but spath has been written specifically for XML and JSON data parsing.

topic Parsing XML log files in Getting Data In

Parsing XML log files

Re: Parsing XML log files