https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607433#M211180 <P>If you don't have file system access then you won't be able to do much with props.conf.&nbsp; You may have to stick with search-time extractions.</P><P>First, however, please share some sample data so we know what we're working with and have something with which to test.</P> Fri, 29 Jul 2022 12:03:50 GMT richgalloway 2022-07-29T12:03:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607424#M211177 <P>I got some embedded XML in a Syslog message.&nbsp; I have no access to get under the bonnet in an admin sense.&nbsp; I need to "grok" the message - ideally into stages&nbsp;</P> <P>1 - extract xml</P> <P>2 - parse xml, split up with eval or something</P> <P>I have seen a bunch of stuff around props.conf - but I guess I need to go to one of the "collector" nodes so it parses at source?&nbsp;</P> Thu, 28 Jul 2022 21:25:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607424#M211177 splunkernator 2022-07-28T21:25:40Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607433#M211180 <P>If you don't have file system access then you won't be able to do much with props.conf.&nbsp; You may have to stick with search-time extractions.</P><P>First, however, please share some sample data so we know what we're working with and have something with which to test.</P> Fri, 29 Jul 2022 12:03:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607433#M211180 richgalloway 2022-07-29T12:03:50Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607456#M211191 <P>Hi thanks - I have had to basically make this up, so the shape of the data below is broadly the same, but utterly fabricated to protect my client.</P><LI-CODE lang="markup">2019-07-29T05:29:26.762Z DEBUG &lt;foo-5-thread-2&gt; [BarAgent] The asynchronousNotification message is: &lt;TERMINALRESPONSE&gt; &lt;SERVERDN&gt;cn=00e5934f-12be-4cbf-8608-a75905dadbe7,ou=foo,dc=bar,dc=hyper,dc=out&lt;/SERVERDN&gt; &lt;SERVERPOOLDN&gt;cn=foo-bar-agent,ou=server groups,dc=bar,dc=hyper,dc=out&lt;/SERVERPOOLDN&gt; &lt;SERVERDNSNAME&gt;FOO-FB02Z-BAR019&lt;/SERVERDNSNAME&gt;</LI-CODE><P>What is interesting it the data doesn't seem "clean" - that there is no closing tag for &lt;foo-5-thread-2&gt; (i.e. no &lt;/foo-5-thread&gt; ; and in other instances there is - if you can provide an example, I can take this away and work on it, much appreciated.</P> Fri, 29 Jul 2022 05:46:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607456#M211191 splunkernator 2022-07-29T05:46:14Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607519#M211228 <P>I agree that appears to be poorly-formatted XML.&nbsp; Unfortunately, Splunk's <FONT face="courier new,courier">spath</FONT> and <FONT face="courier new,courier">xpath</FONT> commands will only parse properly formatted XML.&nbsp; I'm afraid that means you'll have to use a series of rex commands to extract the desired fields.</P><LI-CODE lang="markup">| rex "\&lt;SERVERDN&gt;(?&lt;SERVERDN&gt;[^\&lt;]+)" | rex "\&lt;SERVERPOOLDN&gt;(?&lt;SERVERPOOLDN&gt;[^\&lt;]+)" and so on</LI-CODE> Fri, 29 Jul 2022 12:25:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XMP-parse-XML-and-split-it-up-with-eval/m-p/607519#M211228 richgalloway 2022-07-29T12:25:49Z