Getting Data In

Is there a way to configure Splunk to parse a sourcetype with mixed data types?

daniel333
Builder

All,

I have a log file which is largely key value, with some random human readable language tossed in. Recent upgrades have resulted in XML getting mixed into the party.

Does Splunk have a mode to which might be able to address the mixture of data types in the same logs?

%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12  </value>
<nameofprod>Name </nameofprod>
dump is status="complete"
0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

Question for you pertaining to your example data - would it be multiple 'events' in a similar fashion as:

%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12  </value>
<nameofprod>Name </nameofprod>
dump is status="complete" 
%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12  </value>
<nameofprod>Name </nameofprod>
dump is status="complete"
....

If so, you could (after the data is already in the index) use transaction to encapsulate an entire 'stanza' as one event, then use other search commands to include/exclude what you want.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How complex your xml portion can get?? Is it always just single level values??

0 Karma

daniel333
Builder

It's pretty standard. I've been temped to just SEDCMD away the opening tag with a key=" instead then completely remove the closing tag to just a closing ". But this seems like a lot of manual work. Would be nice is there was a "mixed type" auto extraction option? But if not, maybe the SED option?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...