Alerting

How to extract data in xml data format?

vineela
Path Finder

I need to extract fields from log which is in xml format.
Below is the example:

<Event> <DateTime>2022-11-10T11:58:41.136Z</DateTime> <IBIC8>CTBAAUSN</IBIC8> <InstanceId>D</InstanceId> <EventCode>PAG.NTF.CRL_UPDATE_SUCCESS</EventCode> <Name>CRL update succeeded</Name> <Severity>INFO</Severity> <Class>SECURITY</Class> <Text><![CDATA[CRL was successfully downloaded and validated Context: - URL: https://crlcheck.common.sipn.swift.com:443/SWIFTCA1.crl - Version: 2 - Updated on: Thu Nov 10 21:57:53 AEDT 2022 - Valid till: Sun Nov 13 21:57:53 AEDT 2022 - Issuer: o=swift]]></Text> </Event>


I need to extract fields like eventcode,severity,text .

How can i extract it as statistical data either by using regular expression or how it is...or there is any way to extract the, Please suggest

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

 

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

 

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

 

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

 

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...