xml input

[daxaatfss]

how do i setup xml input like:



12
34


0
99




4
1

Want to create a report of this form:
pqr:1
aa:12 bb:34
aa:0 bb:99
pqr:2
aa:4 bb:1

Have been searching around, but very new to Splunk and seems i couldn't find many pointers to follow.

[daxaatfss]

That works, thank you!
Now i have another problem where i want '' and '' field values to be grouped together by ''. For example,
spath path=abc.pqr{*} gives me something like
1 12(aa)
2 34(bb)
0(aa)
99(bb)
4(aa)
1(bb)

But i want output like:
1 12(aa)
34(bb)
0(aa)
99(bb)
2 4(aa)
1(bb)

[lguinn2]

First, if you want to pull the data into Splunk, you can treat an XML file like any other text file. However, you will probably want to tell Splunk that this is a file that contains multi-line events, and how to identify the break between events. This is a pretty good answer that describes how to set up an XML input: XML Log Sourcetype

Splunk does not automatically parse XML data. In fact, you often don't need to parse in order to search. You can search for all events where the pqr id is 1 simply by putting

<pqr id="1">

in the search box and specifying a time range. Once you have searched for the events that you want to report, you can ask Splunk to do "field extraction" on the events using the xmlkv command. The kv stands for "key-value" and that is what Splunk does - it sets up fields based on the XML tags and values. You can see the fields if you just do this:

yoursearchhere | xmlkv

You can see the fields that Splunk extracted from your xml in the fields sidebar. Use them however you want, perhaps with a table command.

There is also an spath command, which has a couple of examples in the manual here. spath might be more useful in this case.

ADDENDUM: Just found this... There is a way to tell Splunk to automatically create fields for XML data. Edit the appropriate props.conf and add

[yoursourcetypehere]
KV_MODE=xml

If you read the XML Log Sourcetype answer, you could put the KV_MODE=xml right after the line SHOULD_LINEMERGE = True

If you do this, you don't need the xmlkv command at all...