Knowledge Management

How to extract events in xmlns tags

sarvan7777
New Member

Experts,

Here is my Log content and I wish to extract fields like

<tns:SplunkLogs xmlns:tns=\http://www.example.org/SplunkLogs\>\n
    <tns:ServiceName>mmf-bwce-customerOrder.application</tns:ServiceName>\n
    <tns:TransactionId>123</tns:TransactionId>\n
    <tns:EventType>Hold</tns:EventType>\n
    <tns:TimeStamp>2017-06-05T04:04:06.051Z</tns:TimeStamp>\n
    <tns:Payload>123456</tns:Payload>\n
    <tns:ProcessName>Delivery</tns:ProcessName>\n
    <tns:Activity>Request</tns:Activity>\n
</tns:SplunkLogs>\n

All I need is to extract the fields like ServiceName, TransactionId and so on. I have done this thru props.conf and transforms.conf as below and it works perfectly fine. But I wish to move it as a search time extraction (Without a transforms.conf). Any input is appreciated.

my_stanza]
REPORT-xmlkv = xmlkv-alternative

Transforms.conf:
[xmlkv-alternative]
FORMAT = $2::$3
REGEX = <([^\s\>]*):([^\s\>]*)\>([^<]*)\<\/\1:\2\>
Tags (1)
0 Karma

amiftah
Communicator
0 Karma

493669
Super Champion

have a look at spath command:
The spath command enables you to extract information from structured data formats like XML
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/spath

0 Karma

sarvan7777
New Member

Thanks for the response. I was not able to extract the fields with spath as my field values are at the same level. Fortunately, I got a lead to use xmlkv from the documentation link with which I was able to get the desired field extracted. Thanks for your help

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...