Dashboards & Visualizations

Processing multivalue CDATA escaped XML


I would like to have a table of items, but getting this to work is not working out for me. I think because the raw event is slightly hard for me to process. This is a shortened version of my raw event:

EDIT: please note that the "& lt;" and "& gt;" markings below are actually without the space, but otherwise the forum would convert them.

[03/29/2017 15:39:00.115 CEST] BLABLA [nl.morenonsense]
<send exit="sendCoolMessage">
    <![CDATA[& lt;?xml version="1.0" encoding="UTF-8" standalone="yes"?& gt;
      & lt;SendCoolMsg xmlns="http://www.website.com"& gt;
        & lt;CoolAMsg& gt;
          & lt;?xml version="1.0" encoding="UTF-8"?& gt;
          & lt;Items& gt;
            & lt;Item1& gt;
              & lt;information& gt;numbers and stuff& lt;/information& gt;
              & lt;coolthings& gt;strings& lt;/coolthings& gt;
            & lt;/Item1& gt;
            & lt;Item2& gt;
              & lt;information& gt;numbers2 and stuff2& lt;/information& gt;
              & lt;coolthings& gt;strings2& lt;/coolthings& gt;
            & lt;/Item2& gt;
          & lt;/Items& gt;
        & lt;/CoolAmsg& gt;
      & lt;/SendCoolMsg& gt;

I'd like to end up with a table like this:

       information coolthings

I can access the fields (like information) using xmlkv but I haven't been able to get spath to find anything. I have tried using rex to first isolate the inner xml but it seems to only give back results if there is just a string and not any tag for some reason.

search | xmlkv | table _time, information will only give me the information of the first item, I need it to do something multivalued.

search | rex field=_raw "&lt;informatie&gt;(?<Inf>.*)&lt;/informatie&gt;" max_match=0 | mvexpand Inf | table _time, Inf now we have the expanded multivaluedness. But the next step is to use the information in coolthings to filter. If it is strings2 the information shouldn't show up. And I don't know how to get there if I can't use the XML structure. Also the event usually has over 15000 characters (sometimes over 30000), if that is a limit somewhere.

0 Karma
1 Solution


In the end we solved it by exporting all these events and processing them locally with scripts.

View solution in original post


In the end we solved it by exporting all these events and processing them locally with scripts.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...