All Apps and Add-ons

how to split events?

New Member

I have configured REST API and I am getting data into splunk in XML format. But all the data as a single event it is showing and it contains more that 3000 lines in my event. I want to split the event by job id, ie. each job id should have separate events. How it possible?
Thanks in advance.

0 Karma


You will have to create a custom response handler in vi /opt/splunk/etc/apps/Restta/bin/, something like this basing on the data you are querying.
class AlarmHandler:

     def __init__(self,**args):

     def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
         if response_type == "xml": 
             import xml.etree.ElementTree as ET
             alarm_list = ET.fromstring(encodeXMLText(raw_response_output))
             for alarm in alarm_list:
                 alarm_xml_str = ET.tostring(alarm, encoding='utf8', method='xml')

0 Karma

Splunk Employee
Splunk Employee

If you use REST API input, unfortunately it only supports JSON. You can try to:
1. Check if it's possible to get JSON response rather than XML. Some REST endpoint accepts parameters like ?format=json in the URL
2. Switch to Python code input in AoB. You need to right some basic Python codes to send request, then parse the XML and do whatever you want before indexing them.

0 Karma


Can you provide sample data? Do you have time stamps per job?

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...