Is there a way to configure Splunk to parse a sourcetype with mixed data types?

[daniel333]

All,

I have a log file which is largely key value, with some random human readable language tossed in. Recent upgrades have resulted in XML getting mixed into the party.

Does Splunk have a mode to which might be able to address the mixture of data types in the same logs?

%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12  </value>
<nameofprod>Name </nameofprod>
dump is status="complete"

[pgreer_splunk]

Question for you pertaining to your example data - would it be multiple 'events' in a similar fashion as:

%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12  </value>
<nameofprod>Name </nameofprod>
dump is status="complete" 
%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12  </value>
<nameofprod>Name </nameofprod>
dump is status="complete"
....

If so, you could (after the data is already in the index) use transaction to encapsulate an entire 'stanza' as one event, then use other search commands to include/exclude what you want.

[somesoni2]

How complex your xml portion can get?? Is it always just single level values??

[daniel333]

It's pretty standard. I've been temped to just SEDCMD away the opening tag with a key=" instead then completely remove the closing tag to just a closing ". But this seems like a lot of manual work. Would be nice is there was a "mixed type" auto extraction option? But if not, maybe the SED option?