topic Re: How can I extract these XML values and table them? in Splunk Search

How can I extract these XML values and table them?

kaushik1218 — Thu, 17 Aug 2017 18:32:50 GMT

For example below is my XML

<serviceType>xxx</serviceType>
<some stuff>
<some more stuff>
<code>D</code>

Now I need above thing "xxx" as field to the value "D" to be extracted and displayed as below in table format

xxx
D

Can someone please help me here. Thanks in advance

Re: How can I extract these XML values and table them?

azamir_splunk — Thu, 17 Aug 2017 22:46:27 GMT

You can try using KV_MODE = XML in props.conf or use the SPATH command, you can also create a REGEX rule in transforms.conf, depending on what is easier for you to do.

Hope this helps.

Re: How can I extract these XML values and table them?

kaushik1218 — Sat, 19 Aug 2017 18:01:50 GMT

Thanks for your response 🙂