topic Re: how to extract data in xml data format in Alerting

How to extract data in xml data format?

vineela — Thu, 10 Nov 2022 15:35:14 GMT

I need to extract fields from log which is in xml format.
Below is the example:

<Event> <DateTime>2022-11-10T11:58:41.136Z</DateTime> <IBIC8>CTBAAUSN</IBIC8> <InstanceId>D</InstanceId> <EventCode>PAG.NTF.CRL_UPDATE_SUCCESS</EventCode> <Name>CRL update succeeded</Name> <Severity>INFO</Severity> <Class>SECURITY</Class> <Text><![CDATA[CRL was successfully downloaded and validated Context: - URL: https://crlcheck.common.sipn.swift.com:443/SWIFTCA1.crl - Version: 2 - Updated on: Thu Nov 10 21:57:53 AEDT 2022 - Valid till: Sun Nov 13 21:57:53 AEDT 2022 - Issuer: o=swift]]></Text> </Event>

I need to extract fields like eventcode,severity,text .

How can i extract it as statistical data either by using regular expression or how it is...or there is any way to extract the, Please suggest

Re: how to extract data in xml data format

gcusello — Thu, 10 Nov 2022 13:03:07 GMT

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

Re: how to extract data in xml data format

gcusello — Mon, 14 Nov 2022 10:55:33 GMT

Hi @vineela,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉