Dashboards & Visualizations

Extract key-value pairs from xml file

rxdeleon
Explorer

Here's a snippet of a long XML file. I would like to extract the keys such as id, status, error_sequence_number, etc. then assign the value as indicated by the string "value=".
























































Tags (1)
0 Karma

araitz
Splunk Employee
Splunk Employee
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

When defining field extractions for this sourcetype in transforms.conf you can use a regex like so:

[some_stanza]
...
REGEX  = name="(?<_KEY_1>[^"]+)"\s+value="(?<_VAL_1>[^"]+)"
...

Note, you may want to define two of those if the order of name and value can be reversed in your data.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...