topic Why are some fields from XML data not displayed in search results? in Splunk Search

Why are some fields from XML data not displayed in search results?

alexandermunce — Thu, 15 Dec 2016 01:13:53 GMT

When I conduct a generic search on one of our Splunk sources, I am looking for relevant data which will assist with categorizing and analyzing the data.

I noticed that this particular batch of data did not have too many unique identifying fields which were useful for my analysis (eg, customer id, etc).

However, when I took a closer look at some of the results XML data, I could see that there was indeed some relevant identifying data which was contained within tags. For example, for the purpose of this question lets say;

< customer-id >0100000< /customer-id >

(Without the spaces)

I am wondering why this data does not display as a field which I can manipulate/sort by/etc within the search results.

Is this not a valid XML tag which is therefore a field?

Re: Why are some fields from XML data not displayed in search results?

ktugwell_splunk — Thu, 15 Dec 2016 09:25:31 GMT

If the data is close it, or is valid XML, Splunk will recognise it and extract the fields. But you usually have to tell splunk that the data is XML.

Your search | xmlkv

This will tell splunk to extract XML fields at search time. This is however not the most efficient way.

You can set this in your sourcetype (props.conf)

[your_sourcetype]
...
KV_MODE = xml

Give this a try

Thanks

Re: Why are some fields from XML data not displayed in search results?

alexandermunce — Mon, 19 Dec 2016 23:46:13 GMT

Perfect, thank you kindly!

Looks like there are too many irrelevant fields extracted if I use the xmlkv command, so I think I will have to use the rex command to extract the fields I require!