xml search time extraction not working

ssjabid — Tue, 29 Sep 2020 22:26:50 GMT

Hi, I am trying to extract the field tags and values between the interceptor and \Interceptor tags but am not able to, a sample of the xml is below,

<Interceptor>
<AttackCoords>-80.24185962413824,25.24598123976225</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>5</Infiltrators>
<Enforcer>Baleineau</Enforcer>
<ActionDate>2013-07-05</ActionDate>
<ActionTime>06:15:00</ActionTime>
<RecordNotes>
Infiltrators: Izar Carrillo, Bartolo Gracia, Xevera Lerma, Flaca Santiago, Xaviera Villalpando
</RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords/>
<AttackVessel>Raft</AttackVessel>
</Interceptor>

my props.conf and transforms.conf looks like the following

[dreamcrusher]
BREAK_ONLY_BEFORE =
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
PREAMBLE_REGEX = (<\?xml.*||<.*dataroot>)
SEDCMD-dr = s/<\/dataroot>//g
TIME_FORMAT = %Y-%m-%d%n%H:%M:%S
TIME_PREFIX =
MAX_DAYS_AGO = 5000
REPORT-fieldvalues = field
disabled = false
LINE_BREAKER =
TRUNCATE =

[field]
CLEAN_KEYS = 0
REGEX = <(\w+)>([^<]+)
FORMAT=$1::$2
MV_ADD = true

upon ingesting the event data, I can not see any search time fields being extracted and i am not sure where I am going wrong, gone through many similar posts and have tried a few things but no luck unfortunately, am i doing something incorrect with my props and transform conf files? please do enlighten me!

Any help would be greatly appreciated!

Re: xml search time extraction not working

p_gurav — Wed, 26 Dec 2018 05:15:53 GMT

Hi,

Are you using single instance or distributed environment? Where you are putting props and transforms?

topic xml search time extraction not working in Splunk Search

xml search time extraction not working

Re: xml search time extraction not working