Dashboards & Visualizations

Searching and Parsing XML CDATA


I have an XML file that looks like this. It is one event with a break before "<COMBINE>"



<AGENCY><![CDATA[Department of the Housewares]]></AGENCY>

<OFFICE><![CDATA[ Housewaress Central ]]></OFFICE>

<LOCATION><![CDATA[405 5th st.]]></LOCATION>





<SUBJECT><![CDATA[Replace Appliances]]></SUBJECT>



<CONTACT><![CDATA[Ken Mattern, Procurement Manager, Phone 9925-8125]]></CONTACT>

<DESC1><![CDATA[PROJECT TITLE: Replace appliances that have been damaged by flood]]></DESC1>









I'm searching it like this to find all records that contain "Mall"

index="xyz" sourcetype="xyzcombine" Mall
| spath output=Date path=COMBINE.DATE
| spath output=Solicitation path=COMBINE.SOLNBR
| spath output=Subject path=COMBINE.SUBJECT
| spath output=Location path=COMBINE.POPADDRESS
| spath output=Zip path=COMBINE.POPZIP
| spath output=Set-Aside path=COMBINE.SETASIDE
| eval Date= strptime(Date,"%m%d%Y") 
| convert timeformat="%Y-%m-%d"  ctime(Date) AS Date
| table Date, Solicitation, Location, Subject, Set-Aside
| sort Date desc

The search works just fine. However, the word "Mall" can appear anywhere in the record. What I really need to do is to be able to search for "Mall" in the Location or POPADDRESS field. I can't figure out how to do this. I have tried this

index="xyz" sourcetype="xyzcombine" Location*Mall*

With no ressults. I've tried sub searches, WHERE functions and anything else I can think of. It looks to me like fields containing character data, "[CDATA[]]" just don't parse properly.

Any idea of how I can search the specific field?

Tags (3)
0 Karma


I figured out what I was doing wrong. Instead of searching for


I need to search for


Doing that returns exactly what I need, only events with Mall in the Location field. Wildcards do make a difference.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...