topic Re: XML extractions not working in 6 in Dashboards & Visualizations

XML extractions not working in 6

theouhuios — Fri, 21 Feb 2014 15:44:06 GMT

Hello

I did try XML extractions before on 4.3 which used to work fine. But in 6 I seem to have an issue.

Here is my config

BREAK_ONLY_BEFORE =^\<\?xml
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

And the data looks like

<?xml version="1.0" encoding="UTF-8" ?>
<ResultSetData>
<Row>
<Column name="DATE_TIME">2/21/2014 9:35:53</Column>
<Column name="HOST_NAME">xxxxx</Column>
<Column name="INSTANCE_NAME">yyyyy</Column>
<Column name="USERNAME">aaaaaa</Column>
<Column name="PROFILE">zzzzz</Column>
<Column name="ACCOUNT_STATUS">ccccc</Column>
</Row>
</ResultSetData>

Line breaking and timestamp looks good but the field extractions doesn't seem to work.Any ideas?

When I use spath that works again

Re: XML extractions not working in 6

theouhuios — Fri, 21 Feb 2014 18:51:41 GMT

Is it the 2/21/2014 9:35:53 format which is creating an issue? I know that its like 2/21/2014 9:35:53 it wont have any issues. Should I change the format ?

Re: XML extractions not working in 6

aelliott — Fri, 21 Feb 2014 19:19:07 GMT

we have it in the format etc and it works great
In addition, you probably just want to start with the tag right? so you could do break only before ^<ResultSetData etc?

Re: XML extractions not working in 6

theouhuios — Fri, 21 Feb 2014 19:25:47 GMT

I did that too . Line Break isn't really a problem here as I am not really particular about it. Looks like I will have to change the format of the XML now. Is there no way for us to make splunk do those extractions in KV_MODE as XML?

Re: XML extractions not working in 6

theouhuios — Mon, 24 Feb 2014 15:14:24 GMT

Any idea if this can be done?