Getting Data In

How to index XML data in Splunk without row. prefix?

New Member

My XML is as follows:

<row>
    <Id>1</Id>
    <PostId>7</PostId>
    <UserId>2</UserId>
    <VoteTypeId>2</VoteTypeId>
    <CreationDate>2009-11-06T02:22:37.063</CreationDate>
    <TargetUserId>7</TargetUserId>
    <TargetRepChange>10</TargetRepChange>
    <IPAddress>64.127.105.60</IPAddress>
</row>
<row>
    <Id>2</Id>
    <PostId>6</PostId>
    <UserId>2</UserId>
    <VoteTypeId>2</VoteTypeId>
    <CreationDate>2009-11-06T02:22:38.25</CreationDate>
    <TargetUserId>31</TargetUserId>
    <TargetRepChange>10</TargetRepChange>
    <IPAddress>64.127.105.61</IPAddress>
</row>

Splunk labels the columns as row.id, row.IPAddress, etc.

Is there a way to have the fields indexed in splunk without the "row." prefix. I've looked at FIELDALIAS and some other items but they don't do what I'm seeking.

Any help will be greatly appreciated.

Thanks in advance.

Scott

Tags (3)
0 Karma

Path Finder

Try this:

| rename  "row."* as *

SplunkTrust
SplunkTrust

Give this a try (props.conf)

[yoursourcetype]
BREAK_ONLY_BEFORE=<Id>
CHARSET=AUTO
MAX_TIMESTAMP_LOOKAHEAD=150
NO_BINARY_CHECK=1
SEDCMD-acrRemover=s/\x0D//g
SEDCMD-aremove=s/\<row\>//g
SEDCMD-blfRemover=s/\x0A//g
SEDCMD-bremove=s/\<\/row\>//g
SEDCMD-cRemove=s/\<\/\w+\>//g
SEDCMD-dRemove=s/\</" /g
SEDCMD-eRemove=s/\>/="/g
SEDCMD-fRemove=s/^"//g
SHOULD_LINEMERGE=true