Dashboards & Visualizations

How can we convert raw event to XML format in Splunk?

nerelluk
New Member

I want to convert a raw event into an XML viewer format in Splunk. The event is of 30-40 lines.

Sample Event:

Tags (2)
0 Karma

woodcock
Esteemed Legend

You have 2 main tools, but keep in mind that you may have to shape your _raw field before either of them will work:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath

0 Karma

jkat54
SplunkTrust
SplunkTrust

Try using xmlkv, xpath, rex, and/or extract search commands. See if that's what you want.

Also make sure your view is set correctly.

There's table, list, and raw views (selectable with a drop down at the top of the list of events). Raw view will not render the syntax highlighting.

Also fast mode will not auto-extract fields unless they are indexed fields.

0 Karma

niketn
Legend

@nerelluk your requirement is to parse and extract XML data or to show the same as more readable xml format (visualization)?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

nerelluk
New Member

yes ..could you please help me in this

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @nerelluk,

In splunk dashboard you can use HTML and JS - Ref. Add HTML and JS file and use that JS file to display XML content on to the dashboard. For search result you can handle search result from JS. You can use good libraries to display XML nicely.

Hope this helps!!!

0 Karma

nerelluk
New Member

Thanks for the info VatsalJagani

it would be helpful for me if you can brief me...

I am not familiar with JS...

Regards,
Nerellu

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@nerelluk - If you are not much familiar with JS it might take long time to create the feature that you asked for as it is not very straight forward requirement. But some references you can refer for quick start.

How to run search from JS?
And for xml viewer I've already mentioned Js library in the answer.

0 Karma

nerelluk
New Member

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxdsdsassasacdasdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...