topic Re: How do I parse my XML data into multiple fields? in Dashboards & Visualizations

How do I parse my XML data into multiple fields?

dcroteau — Wed, 30 Mar 2016 18:53:46 GMT

Is there a way to break this xml into fields. Customer needs it broken like such:

Would you use spath on something like this?

FIELDNAME/Key1:
COMPUTER.USERRIGHT.MBR.N.D.C.WKNOWN
VALUE1:
ZZZ-ZZV-ZZ141.SSPRIVILEGE.MBR."Domain Admins".CFFY.GROUP.FALSE
FIELDNAME/Key2:
COMPUTER.USERRIGHT.MBR.N.D.C.MBR_WKNOWN
VALUE2:
ZZZ-ZZV-ZZ141.SSPRIVILEGE.MBR."CFFY-SS-TIER A TECK".CFFY.GROUP.FALSE

Re: How do I parse my XML data into multiple fields?

lquinn — Thu, 31 Mar 2016 08:44:25 GMT

You may have to just extract all of the values as separate fields first, e.g. computer, MBR, ... Then do an eval to create the fields that you actually want from the extracted fields.

Re: How do I parse my XML data into multiple fields?

dcroteau — Thu, 31 Mar 2016 11:46:45 GMT

I think you are right. I will let this post linger for a while and see if someone has a "silver bullet" answer.

Re: How do I parse my XML data into multiple fields?

treinke — Thu, 31 Mar 2016 12:01:47 GMT

Typically I add a statement in props.conf to let Splunk know it is XML.

[yoursourcetype]
 KV_MODE = xml
 NO_BINARY_CHECK = 1
 SHOULD_LINEMERGE = false
 TRUNCATE = 0
 pulldown_type = 1

Re: How do I parse my XML data into multiple fields?

dcroteau — Thu, 31 Mar 2016 12:09:19 GMT

Thanks, I did add that.

Re: How do I parse my XML data into multiple fields?

treinke — Thu, 31 Mar 2016 12:12:00 GMT

Then to combine the fields that were extracted you can use the eval command to join different fields together.