Dashboards & Visualizations

How to extract Key Value pair from this XML?

kishorksudha
Explorer

Hi,
I have the below Sample XML file - I need to extract something like

Key1=pk
Value1=ff7688df7f0001016b750bcffc8cd272
Key2=nodeId
Value2=node1

The Keys are not static and it is dynamically generated by the Application.
Request to help on this

<?xml version="1.0" encoding="UTF-8"?>
<java version="1.7.0_95" class="java.beans.XMLDecoder">
 <object class="java.util.LinkedHashMap">
  <void method="put">
   <string>pk</string>
   <string>ff7688df7f0001016b750bcffc8cd272</string>
  </void>
  <void method="put">
   <string>nodeId</string>
   <string>node1</string>
  </void>
  <void method="put">
   <string>sequenceNumber</string>
   <long>190891</long>
  </void>
  <void method="put">
   <string>timeStamp</string>
   <long>1521629422254</long>
  </void>
 </object>
 <object class="java.util.LinkedHashMap">
  <void method="put">
   <string>pk</string>
   <string>fdd05d987f0001017c02ce1ba95593d7</string>
  </void>
  <void method="put">
   <string>nodeId</string>
   <string>node1</string>
  </void>
  <void method="put">
   <string>sequenceNumber</string>
   <long>190890</long>
  </void>
  <void method="put">
   <string>timeStamp</string>
   <long>1521629422231</long>
  </void>
 </object>
0 Karma
1 Solution

javiergn
Super Champion

What about something like the following (assuming your XML is stored in the field myXML):

| spath input=myXML path=java.object.void output=raw
| table raw
| mvexpand raw
| rex field=raw "\<\w+\>(?<key>[^\<+]+)\<\/\w+\>\s*\<\w+\>(?<value>[^\<+]+)\<\/\w+\>"
| eval {key} = value
| stats values(*) as * by raw
| fields - raw, key, value

For example, the following:

| stats count
| eval myXML = "
 <?xml version=\"1.0\" encoding=\"UTF-8\"?>
 <java version=\"1.7.0_95\" class=\"java.beans.XMLDecoder\">
  <object class=\"java.util.LinkedHashMap\">
   <void method=\"put\">
    <string>pk</string>
    <string>ff7688df7f0001016b750bcffc8cd272</string>
   </void>
   <void method=\"put\">
    <string>nodeId</string>
    <string>node1</string>
   </void>
   <void method=\"put\">
    <string>sequenceNumber</string>
    <long>190891</long>
   </void>
   <void method=\"put\">
    <string>timeStamp</string>
    <long>1521629422254</long>
   </void>
  </object>
  <object class=\"java.util.LinkedHashMap\">
   <void method=\"put\">
    <string>pk</string>
    <string>fdd05d987f0001017c02ce1ba95593d7</string>
   </void>
   <void method=\"put\">
    <string>nodeId</string>
    <string>node1</string>
   </void>
   <void method=\"put\">
    <string>sequenceNumber</string>
    <long>190890</long>
   </void>
   <void method=\"put\">
    <string>timeStamp</string>
    <long>1521629422231</long>
   </void>
  </object>
"
| spath input=myXML path=java.object.void output=raw
| table raw
| mvexpand raw
| rex field=raw "\<\w+\>(?<key>[^\<+]+)\<\/\w+\>\s*\<\w+\>(?<value>[^\<+]+)\<\/\w+\>"
| eval {key} = value
| stats values(*) as * by raw
| fields - raw, key, value

Will generate this output:

alt text

View solution in original post

javiergn
Super Champion

What about something like the following (assuming your XML is stored in the field myXML):

| spath input=myXML path=java.object.void output=raw
| table raw
| mvexpand raw
| rex field=raw "\<\w+\>(?<key>[^\<+]+)\<\/\w+\>\s*\<\w+\>(?<value>[^\<+]+)\<\/\w+\>"
| eval {key} = value
| stats values(*) as * by raw
| fields - raw, key, value

For example, the following:

| stats count
| eval myXML = "
 <?xml version=\"1.0\" encoding=\"UTF-8\"?>
 <java version=\"1.7.0_95\" class=\"java.beans.XMLDecoder\">
  <object class=\"java.util.LinkedHashMap\">
   <void method=\"put\">
    <string>pk</string>
    <string>ff7688df7f0001016b750bcffc8cd272</string>
   </void>
   <void method=\"put\">
    <string>nodeId</string>
    <string>node1</string>
   </void>
   <void method=\"put\">
    <string>sequenceNumber</string>
    <long>190891</long>
   </void>
   <void method=\"put\">
    <string>timeStamp</string>
    <long>1521629422254</long>
   </void>
  </object>
  <object class=\"java.util.LinkedHashMap\">
   <void method=\"put\">
    <string>pk</string>
    <string>fdd05d987f0001017c02ce1ba95593d7</string>
   </void>
   <void method=\"put\">
    <string>nodeId</string>
    <string>node1</string>
   </void>
   <void method=\"put\">
    <string>sequenceNumber</string>
    <long>190890</long>
   </void>
   <void method=\"put\">
    <string>timeStamp</string>
    <long>1521629422231</long>
   </void>
  </object>
"
| spath input=myXML path=java.object.void output=raw
| table raw
| mvexpand raw
| rex field=raw "\<\w+\>(?<key>[^\<+]+)\<\/\w+\>\s*\<\w+\>(?<value>[^\<+]+)\<\/\w+\>"
| eval {key} = value
| stats values(*) as * by raw
| fields - raw, key, value

Will generate this output:

alt text

p_gurav
Champion

Hi,

Can you try props and transforms settings as follow:

  1. props.conf:

    [your_sourcetype]
    REPORT-xml = abcxml

  2. transforms.conf:

    [abcxml]
    REGEX = <void method=\"put\">[\n]\s*<\w+>([^<]+)<\/\w+>[\n]\s*<\w+>([^<]+)<\/\w+>
    FORMAT = $1::$2

493669
Super Champion

Hi @kishorksudha,
have a look at this answer:
https://answers.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how.html
You need to modify props.conf and transforms.conf accordingly

0 Karma

kishorksudha
Explorer

Thanks for the response .
If you can take a close look at the XML - it is a bit unique one
wherein for all the Keys it starts and ends with String
The link provided is for classic XML . It will not be able to solve my issue 😞

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...