Getting Data In

Remove XML elements via transforms (keep the tags)

New Member


I am trying to remove elements from XML in a log file using the heavy forwarder via transforms.conf

Tried several variants, this one has come close but is only creating a single  instance of what its found

e.g <name>REDACTED<name>




REGEX = <(.*)>[^<]*<\/\1>
DEST_KEY = _raw


Example, the log file might have:


 <?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>Belgian Waffles</name><price>$5.95</price><description>    Two of our famous Belgian Waffles with plenty of real maple syrup    </description><calories>650</calories> </food> <food><name>Strawberry Belgian Waffles</name><price>$7.95</price><description>Light Belgian waffles covered with strawberries and whipped cream</description><calories>900</calories> </food> <food><name>Berry-Berry Belgian Waffles</name><price>$8.95</price><description>Belgian waffles covered with assorted fresh berries and whipped cream</description><calories>900</calories> </food> <food><name>French Toast</name><price>$4.50</price><description>Thick slices made from our homemade sourdough bread</description><calories>600</calories> </food> <food><name>Homestyle Breakfast</name><price>$6.95</price><description>Two eggs, bacon or sausage, toast, and our ever-popular hash browns</description><calories>950</calories> </food> </breakfast_menu>


And I want to push into splunk the redacted version


 <?xml version="1.0" encoding="UTF-8"?> <breakfast_menu> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> <food><name>REDACTED<name><price>REDACTED<price><description>REDACTED<description><calories>REDACTED<calories> </food> </breakfast_menu> 



Labels (2)
0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...