Getting Data In

XML metadata field extraction

jsanjeb
Explorer

Hi Splunkers,

I am working on field extraction for XML events. I have added regex in transforms.conf for extraction. XML looks like this,

<?xml version="1.0" encoding="UTF-8"?>
<transaction version="6.00" ID="1234" agentRole="sourceAgent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="TransferLog.xsd" xmlns="">
    <field1 time="2018-03-30T19:53:34.472Z">abc</field1>
    <field2 agent="abc" QMgr="abc" agentType="abc">
        <systemInfo architecture="abc" name="abc" version="3.10.0-514.21.2.el7.x86_64"/>
    </field1>
    <field3 agent="abc" QMgr="abc"/>
    <originator>
        <field4>abc</field4>
        <field5>abc</field5>
        <field6>abc</field6>
    </originator>
    <transferSet startTime="2018-03-30T19:53:34.473Z" total="1" bytesSent="0">
        <metaDataSet>
            <metaData key="field7">abc</metaData>
            <metaData key="field8">abc</metaData>
            <metaData key="field9">abc</metaData>
            <metaData key="com.ibm.wmqfte.field10">abc</metaData>
            <metaData key="com.ibm.wmqfte.field11">abc</metaData>
            <metaData key="com.ibm.wmqfte.field12">abc</metaData>           
        </metaDataSet>
    </transferSet>
</transaction>

props.conf

[mft]
category = Custom
pulldown_type = 1
NO_BINARY_CHECK = true
disabled = false
REPORT-xmlkv = xmlkv-alternative

transforms.conf

 [xmlkv-alternative]
 REGEX = <([^\s\>]*)[^\>]*\>([^<]*)\<\/\1\>
 FORMAT = $1::$2

Using the above regex I am able extract tags named field1, field2, field3 field4, field5 and field6 in the XML. However remaining fields inside tag ie field7 to field12 in XML cannot be extracted. Exception here is i need not extract/ ignore all fields in this form com.ibm.wmqfte.field10. Please help me with this extraction.

Thanks

Tags (1)
0 Karma

785978
Engager

I am curios about this as well, i have a similar problem and trying to extract the field name from metadata 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...