https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134083#M7958 <P>hi harish_ka<BR /> can you try this commad <BR /> xmlkv commad <BR /> i think this may help <BR /> thanks</P> Mon, 13 Apr 2015 18:07:21 GMT juvetm 2015-04-13T18:07:21Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134082#M7957 <P>i need to pull complete xml from the event. i tried spath and xpath to pull particular key pair value, but i want the complete xml from the event. i tried rex but its not working. xml looks as below:<BR /> i need to pull the complete xml <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/302iFBBF922F471FC596/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 13 Apr 2015 17:51:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134082#M7957 harish_ka 2015-04-13T17:51:13Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134083#M7958 <P>hi harish_ka<BR /> can you try this commad <BR /> xmlkv commad <BR /> i think this may help <BR /> thanks</P> Mon, 13 Apr 2015 18:07:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134083#M7958 juvetm 2015-04-13T18:07:21Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134084#M7959 <P>it will be really helpful if you Can give an example of xmlkv usage.<BR /> i tried search.....|xmlkv<BR /> but dont know how to get the values as output...</P> Mon, 13 Apr 2015 18:25:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134084#M7959 harish_ka 2015-04-13T18:25:22Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134085#M7960 <P>hi harish_ka<BR /> can you do some thing like this</P> <PRE><CODE> sourcetype="access_c*" | xmlkv | table TransactionId </CODE></PRE> Mon, 13 Apr 2015 18:49:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134085#M7960 juvetm 2015-04-13T18:49:16Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134086#M7961 <P>Thank Juvetm for your answer. But it didnt work for me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Tue, 14 Apr 2015 11:08:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-pull-a-complete-xml-from-event/m-p/134086#M7961 harish_ka 2015-04-14T11:08:09Z