topic Re: How can we convert raw event to XML format in Splunk? in Dashboards & Visualizations

How can we convert raw event to XML format in Splunk?

nerelluk — Mon, 10 Jun 2019 10:07:41 GMT

I want to convert a raw event into an XML viewer format in Splunk. The event is of 30-40 lines.

Sample Event:

Re: How can we convert raw event to XML format in Splunk?

nerelluk — Mon, 10 Jun 2019 10:08:29 GMT

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxdsdsassasacdasdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Re: How can we convert raw event to XML format in Splunk?

VatsalJagani — Mon, 10 Jun 2019 14:29:24 GMT

Hi @nerelluk,

In splunk dashboard you can use HTML and JS - Ref. Add HTML and JS file and use that JS file to display XML content on to the dashboard. For search result you can handle search result from JS. You can use good libraries to display XML nicely.

Hope this helps!!!

Re: How can we convert raw event to XML format in Splunk?

nerelluk — Sun, 16 Jun 2019 04:50:57 GMT

Thanks for the info VatsalJagani

it would be helpful for me if you can brief me...

I am not familiar with JS...

Regards,
Nerellu

Re: How can we convert raw event to XML format in Splunk?

niketn — Sun, 16 Jun 2019 11:49:22 GMT

@nerelluk your requirement is to parse and extract XML data or to show the same as more readable xml format (visualization)?

Re: How can we convert raw event to XML format in Splunk?

jkat54 — Sun, 16 Jun 2019 12:52:13 GMT

Try using xmlkv, xpath, rex, and/or extract search commands. See if that's what you want.

Also make sure your view is set correctly.

There's table, list, and raw views (selectable with a drop down at the top of the list of events). Raw view will not render the syntax highlighting.

Also fast mode will not auto-extract fields unless they are indexed fields.

Re: How can we convert raw event to XML format in Splunk?

VatsalJagani — Sun, 16 Jun 2019 13:28:25 GMT

@nerelluk - If you are not much familiar with JS it might take long time to create the feature that you asked for as it is not very straight forward requirement. But some references you can refer for quick start.

How to run search from JS?
And for xml viewer I've already mentioned Js library in the answer.

Re: How can we convert raw event to XML format in Splunk?

woodcock — Sun, 16 Jun 2019 23:15:17 GMT

You have 2 main tools, but keep in mind that you may have to shape your _raw field before either of them will work:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath

Re: How can we convert raw event to XML format in Splunk?

nerelluk — Fri, 06 Sep 2019 09:55:55 GMT

yes ..could you please help me in this