Getting Data In

Pre-index filtering - filter non-xml lines from xml data

ajaysamantbms
Explorer

My event data contains the foll

POST:....
...
ffffff
ABCD
EFG

WERT
SDF
... and so on

As you see some lines are non-xml and some are xml..

my props.conf file has foll set of rules

[sourcetype]
BREAK_ONLY_BEFORE = ||
KV_MODE = xml
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = true
pulldown_type = 1
TRANSFORMS-set = setnull, setparsing

and in transforms.xml

[setnull]
REGEX= .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = ||
DEST_KEY = queue
FORMAT = indexQueue

Will this work? ...the lines outside XML tags as shown in example should not be indexed..
And should i do this in heavy forwarders or at universal lightweight forwarders

Tags (3)
0 Karma

MuS
Legend

Hi ajaysamantbms,

the problem with this kind of question is always the same:

if this will work in your setup with your data must be tested by yourself and therefore only you will be able to answer if this will work for you or not.

the conf files look ok and the regex matches your XML data. So go ahead and test it 😉

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...