topic Collect values from semi-xml log in Dashboards & Visualizations

Collect values from semi-xml log

carljohan — Thu, 13 Oct 2011 10:11:23 GMT

Hi,

I have a logfile with the following syntax:

2011-10-13 09:34:29,309 [-] [HttpClientWorker-9]  INFO LogMediator To: http://www.w3.org/2005/08/addressing/anonymous,WSAction: ,SOAPAction: ,MessageID: urn:uuid:11111111111111111-222222222,Direction: response,AdjustAccountOutSeqEntry = <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><AdjustAccountResultMsg xmlns="http://www.huawei.com/bme/cbsinterface/cbs/accountmgrmsg">
        <ResultHeader xmlns="">
        <CommandId xmlns="http://www.huawei.com/bme/cbsinterface/common">AdjustAccount</CommandId>
        <Version xmlns="http://www.huawei.com/bme/cbsinterface/common">1</Version>
        <TransactionId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</TransactionId>
        <SequenceId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</SequenceId>
        <ResultCode xmlns="http://www.huawei.com/bme/cbsinterface/common">222222222</ResultCode>
        <ResultDesc xmlns="http://www.huawei.com/bme/cbsinterface/common">There is not enough money in the account.</ResultDesc>
      </ResultHeader>
       <AdjustAccountResult xmlns="" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />
    </AdjustAccountResultMsg></soapenv:Body>

How do I get the SequenceId, ResultCode and ResultDesc values?

Re: Collect values from semi-xml log

Ayn — Thu, 13 Oct 2011 10:19:03 GMT

xmlkv to the rescue!

| xmlkv

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xmlkv

Re: Collect values from semi-xml log

carljohan — Thu, 13 Oct 2011 10:44:49 GMT

Thanks Ayn, I have looked at xmlkv but cant get it to work.
Can you give me a example of how i would use it to extract the ResultCode?

Re: Collect values from semi-xml log

Ayn — Thu, 13 Oct 2011 11:01:06 GMT

It really should be a matter of just running | xmlkv. If for some reason it's not working (I don't know why not, sorry) and you're looking for just any way to make this work, you could extract the fields and values manually with rex, like so:

| rex "<SequenceId [^>]+>(?<SequenceId>[^<]+)"

(and so on for the rest of the values as well)