How do I rename xml fields in props.conf?

[cphair]

I have a file of XML-like events that look like this:

<Event Field1=foo Field2=bar Field3=baz >
    <Data Field4=whz Field5=zip Field3=floo/>
</Event>

Both the Event line and the Data line have a field named Field3, and they are automatically extracted as the same field in the search. Is there a way to prepend the first tag (i.e. either Event or Data) to the Field3 name so Splunk can tell they're distinct? Prepending Event or Data to all the field names would also work.

In props.conf:

[xml_sample]

SHOULD_LINEMERGE = true

DATETIME_CONFIG = NONE

BREAK_ONLY_BEFORE_DATE = false

BREAK_ONLY_BEFORE =]>

MUST_BREAK_AFTER = 

[gabetheISguy]

If its during search time, you can either use the mode=sed with a regular expression

For e.g.

| rex mode=sed "s///g"

OR I would use sedcmd in props.conf

SEDCMD-change_field = s///g

[cphair]

Regexing from the search interface isn't convenient when you have to do it for every search. SEDCMD replaces the raw data, and I just want to update the field names.

[chanfoli · Accepted solution]

I would disable the automatic key-value extractions with KV_MODE = none and then define your own regex based extractions which use the element names, "Event" and "Data" for example as anchors. If you don't know how to set up regex extractions in the config files, the interactive field extractor tool might help you at least get close to the regex you need if not the exact regex you need, depending on your data and how it responds to you removing the values it gets wrong, presuming it selects incorrect fields from other XML elements.

[cphair]

I was hoping there was an easier way, but I guess this'll work. Thanks.