topic XML parsing and field mapping in Getting Data In

XML parsing and field mapping

panwarsagar — Wed, 30 Dec 2020 14:25:29 GMT

Hi,

I have a XML file which i wants to load in Splunk and parse during indexing.

<measType p="1">node_cpu.idle</measType>
<measType p="2">node_cpu.iowait</measType>
<measType p="3">node_cpu.irq</measType>
<measType p="4">node_cpu.nice</measType>
<measType p="5">node_cpu.softirq</measType>
<measType p="6">node_cpu.steal</measType>
<measType p="7">node_cpu.system</measType>
<measType p="8">node_cpu.user</measType>
<measValue measObjLdn="host=xxxxxxxx-auxiliary-0,platform=1,cpu=0,instance=xxxxxxx-auxiliary-0:8001,job=node">
<r p="1">4366091.08</r>
<r p="2">27479.68</r>
<r p="3">0</r>
<r p="4">479</r>
<r p="5">18939.5</r>
<r p="6">1157.43</r>
<r p="7">73459.64</r>
<r p="8">64291.39</r>
</measValue>

This has the measType p1.....p8 and value in measValue p1.....p8. I would like to create field like

node_cpu.idle=4366091.08

node_cpu.iowait=27479.68 and so on.

Could you please guide how I can achieve this using props.conf anf transforms.conf settings

Re: XML parsing and field mapping

to4kawa — Wed, 30 Dec 2020 22:45:45 GMT

https://community.splunk.com/t5/Getting-Data-In/How-to-configure-XML-data-parsing/m-p/279706

Re: XML parsing and field mapping

panwarsagar — Thu, 31 Dec 2020 09:04:57 GMT

Sorry to say this doesn't provide solution to my problem.

Re: XML parsing and field mapping

to4kawa — Thu, 31 Dec 2020 10:13:53 GMT

index=_internal | head 1 | fields _raw | eval _raw="<measType p=\"1\">node_cpu.idle</measType> <measType p=\"2\">node_cpu.iowait</measType> <measType p=\"3\">node_cpu.irq</measType> <measType p=\"4\">node_cpu.nice</measType> <measType p=\"5\">node_cpu.softirq</measType> <measType p=\"6\">node_cpu.steal</measType> <measType p=\"7\">node_cpu.system</measType> <measType p=\"8\">node_cpu.user</measType> <measValue measObjLdn=\"host=xxxxxxxx-auxiliary-0,platform=1,cpu=0,instance=xxxxxxx-auxiliary-0:8001,job=node\"> <r p=\"1\">4366091.08</r> <r p=\"2\">27479.68</r> <r p=\"3\">0</r> <r p=\"4\">479</r> <r p=\"5\">18939.5</r> <r p=\"6\">1157.43</r> <r p=\"7\">73459.64</r> <r p=\"8\">64291.39</r> </measValue>" | spath | eval type=mvzip(measType,'measType{@p}'), value=mvzip('measValue.r','measValue.r{@p}'), tmp=mvzip(type,value) | rename measValue{@measObjLdn} as objLdn | stats values(objLdn) as objLdn by tmp | rex field=tmp "(?<type>[\w.]+),(?<type_p>\d),(?<value>[\w.]+),(?<value_p>\d)" | eval {type}=value | stats values(node_*) as node_* by objLdn | rename objLdn as _raw | kv

If you can extract the fields in props.conf, you should be able to get by with transforms.conf.