Hi Splunkers,
I would like to extract the following xml while indexing..
fields:
host=0.0.0.1
source=mysource
sourcetype=mysourcetype
name=vasu
address=us
xml:
<customvalues>
<customvalue>
<name>host</name>
<value>0.0.0.1</value>
</customvalue>
<customvalue>
<name>source</name>
<value>mysource</value>
</customvalue>
<customvalue>
<name>sourcetype</name>
<value>mysourcetype</value>
</customvalue>
<customvalue>
<name>name</name>
<value>vasu</value>
</customvalue>
<customvalue>
<name>address</name>
<value>US</value>
</customvalue>
</customvalues>
You could set this in props.conf for that sourcetype:
SEDCMD-foo = s/(?s).*?<name>([^<]+).*?<value>([^<]+)(\s*<\/[^>]+>)*/\1="\2" /g
That'll turn your event into this at index time:
host="0.0.0.1" source="mysource" sourcetype="mysourcetype" name="vasu" address="US"
Note, this will not set Splunk's metadata fields host
, source
, sourcetype
automatically - that requires a bit more rewriting in transforms.conf if that's what you're after.
Note, your closing tags aren't valid XML... also, this kind of data structure sucks to work with.
You can take a look at this link
You could set this in props.conf for that sourcetype:
SEDCMD-foo = s/(?s).*?<name>([^<]+).*?<value>([^<]+)(\s*<\/[^>]+>)*/\1="\2" /g
That'll turn your event into this at index time:
host="0.0.0.1" source="mysource" sourcetype="mysourcetype" name="vasu" address="US"
Note, this will not set Splunk's metadata fields host
, source
, sourcetype
automatically - that requires a bit more rewriting in transforms.conf if that's what you're after.
Note, your closing tags aren't valid XML... also, this kind of data structure sucks to work with.
Thanks Martin_Muller,
actually its my mistake, now changed the question with proper tags,I will give a try and update it.