I am using the id in the placemark for my featureIdField
We don't currently support feature IDs from tag attributes. Your best bet is probably to do a manual Regex search & replace directly in the XML.
Something like this
Search: <Placemark id="(ID_[0-9]+)">
Replace: <Placemark><name>$1</name>
Hacky, but should do the trick.
Since the ID is inside the name
tag, Splunk will pick it up automatically and you won't even have to set the feature_id_element
for the KMZ
We don't currently support feature IDs from tag attributes. Your best bet is probably to do a manual Regex search & replace directly in the XML.
Something like this
Search: <Placemark id="(ID_[0-9]+)">
Replace: <Placemark><name>$1</name>
Hacky, but should do the trick.
Since the ID is inside the name
tag, Splunk will pick it up automatically and you won't even have to set the feature_id_element
for the KMZ
Thank you, it gets me one step closer...
I have also tried, but it does not seem to help.
feature_id_element = /Placemark/@id
This is in greater than and less than signs. It did not copy well, even with & code.
<Placemark id="ID_00000">
LIke that ^^^^?
yes, thanks.