Dashboards & Visualizations

Collect values from semi-xml log

Path Finder


I have a logfile with the following syntax:

2011-10-13 09:34:29,309 [-] [HttpClientWorker-9]  INFO LogMediator To: http://www.w3.org/2005/08/addressing/anonymous,WSAction: ,SOAPAction: ,MessageID: urn:uuid:11111111111111111-222222222,Direction: response,AdjustAccountOutSeqEntry = <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><AdjustAccountResultMsg xmlns="http://www.huawei.com/bme/cbsinterface/cbs/accountmgrmsg">
        <ResultHeader xmlns="">
        <CommandId xmlns="http://www.huawei.com/bme/cbsinterface/common">AdjustAccount</CommandId>
        <Version xmlns="http://www.huawei.com/bme/cbsinterface/common">1</Version>
        <TransactionId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</TransactionId>
        <SequenceId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</SequenceId>
        <ResultCode xmlns="http://www.huawei.com/bme/cbsinterface/common">222222222</ResultCode>
        <ResultDesc xmlns="http://www.huawei.com/bme/cbsinterface/common">There is not enough money in the account.</ResultDesc>
       <AdjustAccountResult xmlns="" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />

How do I get the SequenceId, ResultCode and ResultDesc values?

Tags (2)
0 Karma
1 Solution



It really should be a matter of just running | xmlkv. If for some reason it's not working (I don't know why not, sorry) and you're looking for just any way to make this work, you could extract the fields and values manually with rex, like so:

| rex "<SequenceId [^>]+>(?<SequenceId>[^<]+)"

(and so on for the rest of the values as well)

0 Karma

Path Finder

Thanks Ayn, I have looked at xmlkv but cant get it to work.
Can you give me a example of how i would use it to extract the ResultCode?

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...