Getting Data In

Implement Generic Indexer for XML File With Repeating Key Names

moneybox
Explorer

Hi,
I'm using splunk for few weeks and its seems really great but recently i had some issue with one of the needs in a new project.

My target is to perform indexing and searching by tag inside XML Files within the following format


value
value
value
xxxxz
ceijciejci

I have no idea what will be the inner fields and how deep will they go.

a success would be for me a way to index everything by key-Value so i could search any of the keys and get all matching object with proper value within them.

my senses tells me i need to write some generic regex for this so thats what i did:

LINE_BREAKER=(<FileItem>.*?/) ### Object Bounderis

REGEX = <(?<_KEY_1>.+?)>(?<_VAL_1>.+?)<\/.+?> ### Generic Key-Value Indexer

its working really nice but there is one issue.
when i have 2 duplicate key with the same name and different value its seems like splunk takes only the first one of them [for example if i search Blabla=xxxxz it wont return any results]

is there any way to do it better and solve my issue?

Thanks.
:)

Tags (3)
0 Karma

moneybox
Explorer

Thanks Alot!~!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can just add the key

MV_ADD = true

to your transforms extraction. That will turn a field with multiple values into a multi-valued field.

0 Karma

moneybox
Explorer

Thanks :)))

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...