Splunk XML File multi-Tag parsing

[alaaelbahrawy]

I have the following XML format file. I triesd to Parse in Splunk to Reach the Below table format. but i faced an issue to make the Zone repetitive in every line.

<PolicyGlobal>
<Zone>ABC</Zone>
<policy>
<PolicyName>A<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
<policy>
<PolicyName>B<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
</PolicyGlobal>
<PolicyGlobal>
<Zone>DEF</Zone>
<policy>
<PolicyName>C<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
<policy>
<PolicyName>D<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
</PolicyGlobal>>

PolicyName,Attribute1,Attribute2,Zone
A,Value,Value,ABC
B,Value,Value,ABC
C,Value,Value,DEF
D,Value,Value,DEF

I tried to cut the values with LINE_BREAKER : with "PolicyGlobal" it gets all the all the policies in 1 line. and if i changed the LINE_BREAKER value with Policy it doesn't get the Zone
Can you help?

[arjunpkishore5]

can you post the current props.conf please ?

[to4kawa]

| makeresults 
| eval _raw="<PolicyGlobal>
 <Zone>ABC</Zone>
 <policy>
 <PolicyName>A<PolicyName>
 <Attribute1>Value</Attribute1>
 <Attribute2>Value</Attribute2>
 </policy>
 <policy>
 <PolicyName>B<PolicyName>
 <Attribute1>Value</Attribute1>
 <Attribute2>Value</Attribute2>
 </policy>
 </PolicyGlobal>
 <PolicyGlobal>
 <Zone>DEF</Zone>
 <policy>
 <PolicyName>C<PolicyName>
 <Attribute1>Value</Attribute1>
 <Attribute2>Value</Attribute2>
 </policy>
 <policy>
 <PolicyName>D<PolicyName>
 <Attribute1>Value</Attribute1>
 <Attribute2>Value</Attribute2>
 </policy>
 </PolicyGlobal>"
 | makemv delim="
 " _raw
 | stats delim="," list(_raw) as raw
 | nomv raw
 | eval raw=replace(raw,"</PolicyGlobal>,<PolicyGlobal>","</PolicyGlobal>#<PolicyGlobal>")
 | makemv delim="#" raw
 | stats count by raw
 | rex field=raw mode=sed "s/<[\w\/]+>//g"
 | eval raw=trim(raw,",")
 | rex field=raw mode=sed "s/,+/,/g"
 | eval Zone=mvindex(split(raw,","),0), text1=mvindex(split(raw,","),1)." ".mvindex(split(raw,","),2)." ".mvindex(split(raw,","),3)
 , text2=mvindex(split(raw,","),4)." ".mvindex(split(raw,","),5)." ".mvindex(split(raw,","),6)
 | eval tmp=mvappend(text1,text2)
 | mvexpand tmp
 | table Zone tmp
 | eval PolicyName=mvindex(split(tmp," "),0), Attribute1=mvindex(split(tmp," "),1), Attribute2=mvindex(split(tmp," "),2)
 | table Zone PolicyName Attribute*

It ’s too hard to be helpful.