Dashboards & Visualizations

How do I parse my XML data into multiple fields?

dcroteau
Splunk Employee
Splunk Employee

Is there a way to break this xml into fields. Customer needs it broken like such:

Would you use spath on something like this?

FIELDNAME/Key1:
COMPUTER.USERRIGHT.MBR.N.D.C.WKNOWN
VALUE1:
ZZZ-ZZV-ZZ141.SSPRIVILEGE.MBR."Domain Admins".CFFY.GROUP.FALSE
FIELDNAME/Key2:
COMPUTER.USERRIGHT.MBR.N.D.C.MBR_WKNOWN
VALUE2:
ZZZ-ZZV-ZZ141.SSPRIVILEGE.MBR."CFFY-SS-TIER A TECK".CFFY.GROUP.FALSE

alt text

0 Karma

treinke
Builder

Typically I add a statement in props.conf to let Splunk know it is XML.

[yoursourcetype]
 KV_MODE = xml
 NO_BINARY_CHECK = 1
 SHOULD_LINEMERGE = false
 TRUNCATE = 0
 pulldown_type = 1
There are no answer without questions
0 Karma

dcroteau
Splunk Employee
Splunk Employee

Thanks, I did add that.

0 Karma

treinke
Builder

Then to combine the fields that were extracted you can use the eval command to join different fields together.

There are no answer without questions
0 Karma

lquinn
Contributor

You may have to just extract all of the values as separate fields first, e.g. computer, MBR, ... Then do an eval to create the fields that you actually want from the extracted fields.

0 Karma

dcroteau
Splunk Employee
Splunk Employee

I think you are right. I will let this post linger for a while and see if someone has a "silver bullet" answer.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...