How to extract Key Value pair from this XML?

[kishorksudha]

Hi,
I have the below Sample XML file - I need to extract something like

Key1=pk
Value1=ff7688df7f0001016b750bcffc8cd272
Key2=nodeId
Value2=node1

The Keys are not static and it is dynamically generated by the Application.
Request to help on this

<?xml version="1.0" encoding="UTF-8"?>
<java version="1.7.0_95" class="java.beans.XMLDecoder">
 <object class="java.util.LinkedHashMap">
  <void method="put">
   <string>pk</string>
   <string>ff7688df7f0001016b750bcffc8cd272</string>
  </void>
  <void method="put">
   <string>nodeId</string>
   <string>node1</string>
  </void>
  <void method="put">
   <string>sequenceNumber</string>
   <long>190891</long>
  </void>
  <void method="put">
   <string>timeStamp</string>
   <long>1521629422254</long>
  </void>
 </object>
 <object class="java.util.LinkedHashMap">
  <void method="put">
   <string>pk</string>
   <string>fdd05d987f0001017c02ce1ba95593d7</string>
  </void>
  <void method="put">
   <string>nodeId</string>
   <string>node1</string>
  </void>
  <void method="put">
   <string>sequenceNumber</string>
   <long>190890</long>
  </void>
  <void method="put">
   <string>timeStamp</string>
   <long>1521629422231</long>
  </void>
 </object>

[javiergn · Accepted solution]

What about something like the following (assuming your XML is stored in the field myXML):

| spath input=myXML path=java.object.void output=raw
| table raw
| mvexpand raw
| rex field=raw "\<\w+\>(?<key>[^\<+]+)\<\/\w+\>\s*\<\w+\>(?<value>[^\<+]+)\<\/\w+\>"
| eval {key} = value
| stats values(*) as * by raw
| fields - raw, key, value

For example, the following:

| stats count
| eval myXML = "
 <?xml version=\"1.0\" encoding=\"UTF-8\"?>
 <java version=\"1.7.0_95\" class=\"java.beans.XMLDecoder\">
  <object class=\"java.util.LinkedHashMap\">
   <void method=\"put\">
    <string>pk</string>
    <string>ff7688df7f0001016b750bcffc8cd272</string>
   </void>
   <void method=\"put\">
    <string>nodeId</string>
    <string>node1</string>
   </void>
   <void method=\"put\">
    <string>sequenceNumber</string>
    <long>190891</long>
   </void>
   <void method=\"put\">
    <string>timeStamp</string>
    <long>1521629422254</long>
   </void>
  </object>
  <object class=\"java.util.LinkedHashMap\">
   <void method=\"put\">
    <string>pk</string>
    <string>fdd05d987f0001017c02ce1ba95593d7</string>
   </void>
   <void method=\"put\">
    <string>nodeId</string>
    <string>node1</string>
   </void>
   <void method=\"put\">
    <string>sequenceNumber</string>
    <long>190890</long>
   </void>
   <void method=\"put\">
    <string>timeStamp</string>
    <long>1521629422231</long>
   </void>
  </object>
"
| spath input=myXML path=java.object.void output=raw
| table raw
| mvexpand raw
| rex field=raw "\<\w+\>(?<key>[^\<+]+)\<\/\w+\>\s*\<\w+\>(?<value>[^\<+]+)\<\/\w+\>"
| eval {key} = value
| stats values(*) as * by raw
| fields - raw, key, value

Will generate this output:

[p_gurav]

Hi,

Can you try props and transforms settings as follow:

1. props.conf:

   [your_sourcetype]
   REPORT-xml = abcxml

2. transforms.conf:

   [abcxml]
   REGEX = <void method=\"put\">[\n]\s*<\w+>([^<]+)<\/\w+>[\n]\s*<\w+>([^<]+)<\/\w+>
   FORMAT = $1::$2

[493669]

Hi @kishorksudha,
have a look at this answer:
https://answers.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how.html
You need to modify props.conf and transforms.conf accordingly

[kishorksudha]

Thanks for the response .
If you can take a close look at the XML - it is a bit unique one
wherein for all the Keys it starts and ends with String
The link provided is for classic XML . It will not be able to solve my issue 😞