XML metadata field extraction

jsanjeb — Wed, 18 Apr 2018 10:41:08 GMT

Hi Splunkers,

I am working on field extraction for XML events. I have added regex in transforms.conf for extraction. XML looks like this,

<?xml version="1.0" encoding="UTF-8"?>
<transaction version="6.00" ID="1234" agentRole="sourceAgent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="TransferLog.xsd" xmlns="">
    <field1 time="2018-03-30T19:53:34.472Z">abc</field1>
    <field2 agent="abc" QMgr="abc" agentType="abc">
        <systemInfo architecture="abc" name="abc" version="3.10.0-514.21.2.el7.x86_64"/>
    </field1>
    <field3 agent="abc" QMgr="abc"/>
    <originator>
        <field4>abc</field4>
        <field5>abc</field5>
        <field6>abc</field6>
    </originator>
    <transferSet startTime="2018-03-30T19:53:34.473Z" total="1" bytesSent="0">
        <metaDataSet>
            <metaData key="field7">abc</metaData>
            <metaData key="field8">abc</metaData>
            <metaData key="field9">abc</metaData>
            <metaData key="com.ibm.wmqfte.field10">abc</metaData>
            <metaData key="com.ibm.wmqfte.field11">abc</metaData>
            <metaData key="com.ibm.wmqfte.field12">abc</metaData>           
        </metaDataSet>
    </transferSet>
</transaction>

props.conf

[mft]
category = Custom
pulldown_type = 1
NO_BINARY_CHECK = true
disabled = false
REPORT-xmlkv = xmlkv-alternative

transforms.conf

 [xmlkv-alternative]
 REGEX = <([^\s\>]*)[^\>]*\>([^<]*)\<\/\1\>
 FORMAT = $1::$2

Using the above regex I am able extract tags named field1, field2, field3 field4, field5 and field6 in the XML. However remaining fields inside tag ie field7 to field12 in XML cannot be extracted. Exception here is i need not extract/ ignore all fields in this form com.ibm.wmqfte.field10. Please help me with this extraction.

Thanks

Re: XML metadata field extraction

785978 — Thu, 12 Nov 2020 20:03:00 GMT

I am curios about this as well, i have a similar problem and trying to extract the field name from metadata

topic XML metadata field extraction in Getting Data In

XML metadata field extraction

Re: XML metadata field extraction