Getting Data In

Indexing xml log file input

Path Finder

I have a log file wherea typical line entry is as below ... I am trying to construct REGEX to be included in the "transforms.conf" file on indexer to break the line into fields such as "NS" , "subproduct", "command" , "result" ,"time" I.E by XML tags .Any help is appreciated

20110803 000000| 427urn:ietf:params:xml:ns:domain-1.0dotTVcheck1000

Tags (1)

Path Finder

I tried this and still not able to get the data extracted ..Here are mt props.conf and transforms.conf entries

Props.conf

[source::...tcpig.\d+.\sla.\$]

sourcetype = ig_sla

[ig_sla]

TIME_FORMAT = %Y%m%d %H%M%S

TZ = US/Eastern

MAX_EVENTS=1

SHOULD_LINEMERGE = false

LINE_BREAKER = >\s*(?=<rttlog>)

REPORT-xmlext = xml-extr

transforms.conf

[xml-extr]

REGEX = <(\w+)>([^<]+)</

FORMAT = regid::"$1" NS::"$2" subproduct::"$3" command::"$4" responsecode::"$5"
response
time::"$6"

Influencer

REGEX = <(\w+)>([^<]+)</

0 Karma

Influencer

Can you make sure that the sourcetype is actually applied to those events? There is a bug on splunkbase, that doubles the backslashes . There should only be one in the REGEX stanza...

Influencer

This should work:

transforms.conf

[simple-xml-tags]
REGEX = <(\w+)>([^<]+)</
FORMAT = $1::$2

props.conf

[my_sourcetype]
REPORT-xml-tags = simple-xml-tags