Getting Data In

How to extract XML fields combining event?

tp92222
Explorer
<?xml version="1.0"?>

-<Customers to="1234" from="1240" time_t="1464236385853">


-<Customer id="1234">

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

<Priority value="1">Medium</Priority>

<Type>Buesiness</Type>

<ID>007-123</ID>

<Title>More store</Title>


-<Contacts>

<Contact>Reference1</Contact>

<Contact>Reference2</Contact>

<Contact>Reference</Contact>

<Contact>Reference</Contact>

</Contacts>

<Summary>Summary of Customer</Summary>

<Analysis>purchase anaysis </Analysis>


<Rating>

<customer rating>3</customer rating>

<Rating>
</Customer>
<Customer id="1235">

similer as above

</Customer>
</Customers>

i modified props.config as following

[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1

probleam is splunk creat 3 events for each customer inforamtion

event one

event two

2013-02-09 20:40:10

event 3
2016-03-23 18:20:06

Medium

Buesiness

007-123

-

Reference1

Reference2

Reference

Reference

Summary of Customer

purchase anaysis

3

i want one customers info in single event

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Can you try this:

[XML]
 DATETIME_CONFIG = CURRENT
 KV_MODE = xml
 LINE_BREAKER = (\<Customers)
 MUST_BREAK_AFTER = \<\/Customers\>
 NO_BINARY_CHECK = 1
 SHOULD_LINEMERGE = false
 TRUNCATE = 0
 pulldown_type = 1

your line breaker has an extra ">" that is not in you data

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

tp92222
Explorer

UPDATED
<?xml version="1.0"?>

-<Customers to="1234" from="1240" time_t="1464236385853">


-<Customer id="1234">

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

<Priority value="1">Medium</Priority>

<Type>Buesiness</Type>

<ID>007-123</ID>

<Title>More store</Title>


-<Contacts>

<Contact>Reference1</Contact>

<Contact>Reference2</Contact>

<Contact>Reference</Contact>

<Contact>Reference</Contact>

</Contacts>

<Summary>Summary of Customer</Summary>

<Analysis>purchase anaysis </Analysis>


<Rating>

<customer rating>3</customer rating>

<Rating>
</Customer>
<Customer id="1235">

similer as above

</Customer>
</Customers>

i modified props.config as following

[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1

probleam is splunk creat 3 events for each customer inforamtion

event one

   -<Customers to="1234" from="1240" time_t="1464236385853">


    -<Customer id="1234">

event two

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

event 3

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

    <Priority value="1">Medium</Priority>

    <Type>Buesiness</Type>

    <ID>007-123</ID>

    <Title>More store</Title>


    -<Contacts>

    <Contact>Reference1</Contact>

    <Contact>Reference2</Contact>

    <Contact>Reference</Contact>

    <Contact>Reference</Contact>

    </Contacts>

    <Summary>Summary of Customer</Summary>

    <Analysis>purchase anaysis </Analysis>


    <Rating>

    <customer rating>3</customer rating>

    <Rating>
    </Customer>
    <Customer id="1235">

    similer as above

    </Customer>
    </Customers>

i want one customers info in single event

0 Karma

jkat54
SplunkTrust
SplunkTrust

FWIW you cant use LINE_BREAKER and MUST_BREAK_AFTER. You'll want to carefully re-read that section of props.conf.spec

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...