Knowledge Management

How to extract events in xmlns tags

sarvan7777
New Member

Experts,

Here is my Log content and I wish to extract fields like

<tns:SplunkLogs xmlns:tns=\http://www.example.org/SplunkLogs\>\n
    <tns:ServiceName>mmf-bwce-customerOrder.application</tns:ServiceName>\n
    <tns:TransactionId>123</tns:TransactionId>\n
    <tns:EventType>Hold</tns:EventType>\n
    <tns:TimeStamp>2017-06-05T04:04:06.051Z</tns:TimeStamp>\n
    <tns:Payload>123456</tns:Payload>\n
    <tns:ProcessName>Delivery</tns:ProcessName>\n
    <tns:Activity>Request</tns:Activity>\n
</tns:SplunkLogs>\n

All I need is to extract the fields like ServiceName, TransactionId and so on. I have done this thru props.conf and transforms.conf as below and it works perfectly fine. But I wish to move it as a search time extraction (Without a transforms.conf). Any input is appreciated.

my_stanza]
REPORT-xmlkv = xmlkv-alternative

Transforms.conf:
[xmlkv-alternative]
FORMAT = $2::$3
REGEX = <([^\s\>]*):([^\s\>]*)\>([^<]*)\<\/\1:\2\>
Tags (1)
0 Karma

amiftah
Communicator
0 Karma

493669
Super Champion

have a look at spath command:
The spath command enables you to extract information from structured data formats like XML
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/spath

0 Karma

sarvan7777
New Member

Thanks for the response. I was not able to extract the fields with spath as my field values are at the same level. Fortunately, I got a lead to use xmlkv from the documentation link with which I was able to get the desired field extracted. Thanks for your help

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...