Getting Data In

Splunk XML data formatting

smusunuri1
New Member

I trying to split the xml data while pushing into splunk. I had a tough time working on this as this a combination of XML and CSV format.

Input:

10:26:10 PST 16 Nov 2015
    <employee details="ename;position;branch" department="XYZ">AA;systems engineer;seattle
</employee>

1:26:10 PST 16 Nov 2015
    <employee details="ename;position;branch" department="XYZ">BB;Lead;seattle
CC;Tech Lead,Redmond    
</employee>

6:26:10 PST 16 Nov 2015
    <employee details="ename;position;branch" department="XYZ">DD;data architect;annapolis
</employee>

Expected Output:

ename position branch
AA systems engineer seattle
BB Lead seattle
CC Tech Lead Redmond
DD data architect annapolis

Tags (1)
0 Karma

sundareshr
Legend

Unless this sample is incomplete, I don't see valid XML. If this data is correct, then you can strip out the unwanted data using SEDCMD in your props.conf like this

SEDCMD-removeunwanted=s/(\<.*\>)//g

http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles

Now to extract the fields, use the DELIMS in your transforms... like so

[extract_fields]
DELIMS = ";"
FIELDS = "ename", "position", "branch"

http://docs.splunk.com/Documentation/Splunk/6.1/admin/Transformsconf

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...