Dashboards & Visualizations

How to parse xml with combination of child nodes and name-value pairs?

leesahic
Engager

I am trying to parse xml such as the following. There are other element types in the xml, but I do not care about those.
<?xml version="1.0" encoding="utf-8"?>











I am trying to extract the data so that I get project{@name}, project{@ingredient}, etc. I would also like to be able to access the annotation KV pairs associated with the project. However, I am getting individual fields such as name, ingredient, pkg-path, etc., and no extraction of the annotation KV pairs.

With the following configuration, I am seeing the events as I expect, which includes, so the line breaking is working. However the field extractions are not working as desired.

props.conf:
    [kitmanifest]
    LINE_BREAKER = ([\r\n])*\<project
    NO_BINARY_CHECK = true
    TIME_FORMAT = %Y%m%dT%H%M%S%z
    TIME_PREFIX = time="
    TRUNCATE = 0
    category = Custom
    SHOULD_LINEMERGE = true
    KV_MODE = xml

    TRANSFORMS-KitManifestBuildIdExtract = KitManifestBuildIdExtract
    BREAK_ONLY_BEFORE = ([\r\n])*\<project
    DATETIME_CONFIG =
    disabled = false

transforms.conf:
    [KitManifestBuildIdExtract]
    REGEX = BuildId_(\S+)\.xml
    SOURCE_KEY = MetaData:Source
    FORMAT = kitmanifest_buildid::$1
    WRITE_META = true

I have spent a fair amount of time reading other xml questions, Splunk doc, etc., but so far no joy.

Ultimately, I need to be able to join the ingredient to another event type in order to be able to report on an ingredient's version, type, etc.

Any help would be greatly appreciated 🙂

0 Karma

leesahic
Engager

Trying to post sample xml, it is not showing in the original post:

<project name="I1" ingredient="I1" pkg-path="Tools\I1" version="4.0.3.1" artifactory="default" type="bldtool" hsd-full-name="tool.BKC – I1">
    <platforms />
    <annotations>
      <annotation name="maintainer" value="sally@mysite.com" />
      <annotation name="vendor" value="myvendor" />
      <annotation name="division" value="mydivision" />
    </annotations>
  </project>
0 Karma

adonio
Ultra Champion

thanks for the sample!
looks like the you have a closing attribute without an opening one <platforms /> is the data exactly like shown or a typo / bad copy paste?

0 Karma

leesahic
Engager

That is exactly as shown. For other projects, platforms nodes include platform nodes, but in this case there are no child platform nodes. Same is true when there are no annotations child nodes.

0 Karma

leesahic
Engager

The results are the same with KV_MODE=auto, this is the default field extraction behavior for name=value

0 Karma

adonio
Ultra Champion

can you add a sample data and desired results?

0 Karma

adonio
Ultra Champion

hello there,

driving with eyes closed here...
maybe try and change KV_MODE = xml to KV_MODE = auto

hope it solves it

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...