All Apps and Add-ons

how to split events?

New Member

I have configured REST API and I am getting data into splunk in XML format. But all the data as a single event it is showing and it contains more that 3000 lines in my event. I want to split the event by job id, ie. each job id should have separate events. How it possible?
Thanks in advance.

0 Karma


You will have to create a custom response handler in vi /opt/splunk/etc/apps/Restta/bin/, something like this basing on the data you are querying.
class AlarmHandler:

     def __init__(self,**args):

     def __call__(self, response_object,raw_response_output,response_type,req_args,endpoint):
         if response_type == "xml": 
             import xml.etree.ElementTree as ET
             alarm_list = ET.fromstring(encodeXMLText(raw_response_output))
             for alarm in alarm_list:
                 alarm_xml_str = ET.tostring(alarm, encoding='utf8', method='xml')

0 Karma

Splunk Employee
Splunk Employee

If you use REST API input, unfortunately it only supports JSON. You can try to:
1. Check if it's possible to get JSON response rather than XML. Some REST endpoint accepts parameters like ?format=json in the URL
2. Switch to Python code input in AoB. You need to right some basic Python codes to send request, then parse the XML and do whatever you want before indexing them.

0 Karma


Can you provide sample data? Do you have time stamps per job?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...