Dashboards & Visualizations

XML extractions not working in 6

theouhuios
Motivator

Hello

I did try XML extractions before on 4.3 which used to work fine. But in 6 I seem to have an issue.

Here is my config

BREAK_ONLY_BEFORE =^\<\?xml
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

And the data looks like

<?xml version="1.0" encoding="UTF-8" ?>
<ResultSetData>
<Row>
<Column name="DATE_TIME">2/21/2014 9:35:53</Column>
<Column name="HOST_NAME">xxxxx</Column>
<Column name="INSTANCE_NAME">yyyyy</Column>
<Column name="USERNAME">aaaaaa</Column>
<Column name="PROFILE">zzzzz</Column>
<Column name="ACCOUNT_STATUS">ccccc</Column>
</Row>
</ResultSetData>

Line breaking and timestamp looks good but the field extractions doesn't seem to work.Any ideas?

When I use spath that works again

Tags (1)
0 Karma

theouhuios
Motivator

Any idea if this can be done?

0 Karma

aelliott
Motivator

we have it in the format etc and it works great
In addition, you probably just want to start with the tag right? so you could do break only before ^<ResultSetData etc?

0 Karma

theouhuios
Motivator

I did that too . Line Break isn't really a problem here as I am not really particular about it. Looks like I will have to change the format of the XML now. Is there no way for us to make splunk do those extractions in KV_MODE as XML?

0 Karma

theouhuios
Motivator

Is it the 2/21/2014 9:35:53 format which is creating an issue? I know that its like 2/21/2014 9:35:53 it wont have any issues. Should I change the format ?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...