after iindesing the xml tags i am getting the as show below
i am getting trouble how extract the data from it
<IDX_BASE>B1102</IDX_BASE>
<NOM_BASE>LANDES DE COUESME</NOM_BASE>
<IDX_EQUIPEMENT>501</IDX_EQUIPEMENT>
<NOM_EQUIPEMENT>E3</NOM_EQUIPEMENT>
<DH_CONTROLE>2/6/2018 16:6:4</DH_CONTROLE>
<ETAT_ALARME>ALM</ETAT_ALARME>
<AVIS_EXPERT>ACCEPTABLE</AVIS_EXPERT>
<RESUME_DIAG>MB: chocs \xE9pisodiques</RESUME_DIAG>
<DETAILS_DIAG>
Hello can you try this please:
in the props.conf
[xml2]
DATETIME_CONFIG =
NO_BINARY_CHECK = 1
category = Structured
pulldown_type = 1
SHOULD_LINEMERGE = true
REPORT-xmlkv = xml_trans2
disabled = false
in your transforms.conf add :
[xml_trans2]
REGEX=<([^>]+)>([^<]+)<\/\1>
FORMAT=$1::$2
MV_ADD = true
@mintucs, your XML Data schema seems incorrect. There should be a root node under which above xml child nodes should be present. If you have xml data in raw events, you can enable KV_MODE=xml
in props.conf to have Splunk automatically extract the fields from XML data during search time field discovery.
On similar lines please try the following run anywhere example where | makeresults
and | eval _raw
pipes generate dummy data as per the question. (PS: I have added <SOMENODE>
as root node for the xml to become a valid xml so that spath can work):
| makeresults
| eval _raw="<SOMENODE>
<IDX_BASE>B1102</IDX_BASE>
<NOM_BASE>LANDES DE COUESME</NOM_BASE>
<IDX_EQUIPEMENT>501</IDX_EQUIPEMENT>
<NOM_EQUIPEMENT>E3</NOM_EQUIPEMENT>
<DH_CONTROLE>2/6/2018 16:6:4</DH_CONTROLE>
<ETAT_ALARME>ALM</ETAT_ALARME>
<AVIS_EXPERT>ACCEPTABLE</AVIS_EXPERT>
<RESUME_DIAG>MB: chocs \xE9pisodiques</RESUME_DIAG>
</SOMENODE>"
| spath