Dashboards & Visualizations

Searching and Parsing XML CDATA

kmattern
Builder

I have an XML file that looks like this. It is one event with a break before "<COMBINE>"

<COMBINE>

<DATE>12152013</DATE>

<AGENCY><![CDATA[Department of the Housewares]]></AGENCY>

<OFFICE><![CDATA[ Housewaress Central ]]></OFFICE>

<LOCATION><![CDATA[405 5th st.]]></LOCATION>

<ZIP>29318</ZIP>

<CLASSCOD>Y</CLASSCOD>

<NAICS>109ha74</NAICS>

<OFFADD><![CDATA[]]></OFFADD>

<SUBJECT><![CDATA[Replace Appliances]]></SUBJECT>

<SOLNBR><![CDATA[SAC-73816327]]></SOLNBR>

<RESPDATE>12272013</RESPDATE>

<CONTACT><![CDATA[Ken Mattern, Procurement Manager, Phone 9925-8125]]></CONTACT>

<DESC1><![CDATA[PROJECT TITLE: Replace appliances that have been damaged by flood]]></DESC1>

<LINK><![CDATA[]]></LINK>

<SETASIDE>N/A</SETASIDE>

<POPCOUNTRY><![CDATA[US]]></POPCOUNTRY>

<POPADDRESS><![CDATA[Local Mall]]></POPADDRESS>

<RECOVERY_ACT>N</RECOVERY_ACT>

<DOCUMENT_PACKAGES><PACKAGE><![CDATA[XYZZY]]></PACKAGE>

</DOCUMENT_PACKAGES>

</COMBINE>

I'm searching it like this to find all records that contain "Mall"

index="xyz" sourcetype="xyzcombine" Mall
| spath output=Date path=COMBINE.DATE
| spath output=Solicitation path=COMBINE.SOLNBR
| spath output=Subject path=COMBINE.SUBJECT
| spath output=Location path=COMBINE.POPADDRESS
| spath output=Zip path=COMBINE.POPZIP
| spath output=Set-Aside path=COMBINE.SETASIDE
| eval Date= strptime(Date,"%m%d%Y") 
| convert timeformat="%Y-%m-%d"  ctime(Date) AS Date
| table Date, Solicitation, Location, Subject, Set-Aside
| sort Date desc

The search works just fine. However, the word "Mall" can appear anywhere in the record. What I really need to do is to be able to search for "Mall" in the Location or POPADDRESS field. I can't figure out how to do this. I have tried this

index="xyz" sourcetype="xyzcombine" Location*Mall*

With no ressults. I've tried sub searches, WHERE functions and anything else I can think of. It looks to me like fields containing character data, "[CDATA[]]" just don't parse properly.

Any idea of how I can search the specific field?

Tags (3)
0 Karma

kmattern
Builder

I figured out what I was doing wrong. Instead of searching for

"Location**Mall*"

I need to search for

"*POPADDRESS*Mall*"

Doing that returns exactly what I need, only events with Mall in the Location field. Wildcards do make a difference.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...