XML Transformation

[varun85negi]

Hi,

I have a XML file with below format:

Header
Parent1
Child1
Child1
Child1
Parent2
Child2
Child2
And So on.
There can be 100K Children under a parent.

Problem is parent child correlation is based on the format of the xml, but when events are indexed in splunk (child and parent separately) there is no way to find the parent for a child (ParentId is not present in Child events).

Is there any way we can enrich the children with the parentId while file is getting indexed.

Thanks,
Varun Negi

[niketn]

@varun85negi, exact structure of parent and child node/s will be required for us to assist you better as you need to parse and split event before indexing based on regular expression. Do each of Parent Nodes have timestamp field as one of their child node? If not whether there is a node in Header for time or can it be random node?