Getting Data In

Dumping XML logs

20065945
Explorer

I want to dump the following XML log file keeping in mind the fact that it should give all the tags as a fields such that I could search the events where

Text="Application: Directory started" Category="BIG" Module="WorkflowHost"

What should I write in props.conf


b476f836-36dd-4c30-9a8e-0587c5d34b8d
2014-01-09 10:45:31.69
Application: Directory started
BIG
Workflow
Event
General
WorkflowHost


0
5420
e2ac3262e9b9d03f



b476f836-36dd-4c30-9a8e-0587c5d34b8d
2014-01-09 10:45:41.57
Application: PatientDirectory started
BIG
PatientDirectory
Event
General
PatientDirectory


0
2180
e2ac3262e9b9d03f



b476f836-36dd-4c30-9a8e-0587c5d34b8d
2014-01-09 10:45:42.15
Application: Report started
BIG
Workflow
Event
General
WorkflowHost


0
5420
e2ac3262e9b9d03f


PLs help....:)

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

This works fine for me with your sample data.

On Indexer,

props.conf

[thexml]
BREAK_ONLY_BEFORE = ^\<message\>
MAX_TIMESTAMP_LOOKAHEAD = 150
NO_BINARY_CHECK = 1
pulldown_type = 1
REPORT-xmlext = xmlkv-alternative

transforms.conf

[xmlkv-alternative]
REGEX = <([^\s\>]*)[^\>]*\>([^<]*)\<\/\1\>
FORMAT = $1::$2

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

This works fine for me with your sample data.

On Indexer,

props.conf

[thexml]
BREAK_ONLY_BEFORE = ^\<message\>
MAX_TIMESTAMP_LOOKAHEAD = 150
NO_BINARY_CHECK = 1
pulldown_type = 1
REPORT-xmlext = xmlkv-alternative

transforms.conf

[xmlkv-alternative]
REGEX = <([^\s\>]*)[^\>]*\>([^<]*)\<\/\1\>
FORMAT = $1::$2

20065945
Explorer

Thanks strive but I went through all these links. There is no solution over there. All the conversations are stuck at one point. Hence failure. 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...