I am trying to parse xml such as the following. There are other element types in the xml, but I do not care about those.
<?xml version="1.0" encoding="utf-8"?>
I am trying to extract the data so that I get project{@name}, project{@ingredient}, etc. I would also like to be able to access the annotation KV pairs associated with the project. However, I am getting individual fields such as name, ingredient, pkg-path, etc., and no extraction of the annotation KV pairs.
With the following configuration, I am seeing the events as I expect, which includes, so the line breaking is working. However the field extractions are not working as desired.
props.conf:
[kitmanifest]
LINE_BREAKER = ([\r\n])*\<project
NO_BINARY_CHECK = true
TIME_FORMAT = %Y%m%dT%H%M%S%z
TIME_PREFIX = time="
TRUNCATE = 0
category = Custom
SHOULD_LINEMERGE = true
KV_MODE = xml
TRANSFORMS-KitManifestBuildIdExtract = KitManifestBuildIdExtract
BREAK_ONLY_BEFORE = ([\r\n])*\<project
DATETIME_CONFIG =
disabled = false
transforms.conf:
[KitManifestBuildIdExtract]
REGEX = BuildId_(\S+)\.xml
SOURCE_KEY = MetaData:Source
FORMAT = kitmanifest_buildid::$1
WRITE_META = true
I have spent a fair amount of time reading other xml questions, Splunk doc, etc., but so far no joy.
Ultimately, I need to be able to join the ingredient to another event type in order to be able to report on an ingredient's version, type, etc.
Any help would be greatly appreciated 🙂
Trying to post sample xml, it is not showing in the original post:
<project name="I1" ingredient="I1" pkg-path="Tools\I1" version="4.0.3.1" artifactory="default" type="bldtool" hsd-full-name="tool.BKC – I1">
<platforms />
<annotations>
<annotation name="maintainer" value="sally@mysite.com" />
<annotation name="vendor" value="myvendor" />
<annotation name="division" value="mydivision" />
</annotations>
</project>
thanks for the sample!
looks like the you have a closing attribute without an opening one <platforms />
is the data exactly like shown or a typo / bad copy paste?
That is exactly as shown. For other projects, platforms nodes include platform nodes, but in this case there are no child platform nodes. Same is true when there are no annotations child nodes.
The results are the same with KV_MODE=auto, this is the default field extraction behavior for name=value
can you add a sample data and desired results?
hello there,
driving with eyes closed here...
maybe try and change KV_MODE = xml
to KV_MODE = auto
hope it solves it