Transforming special characters in XML

[jedatt01]

I have an XML based source that has special characters defined. See below

&   &   
<   &lt;    
>   &gt;    
"   &quot;  
'   &apos;  

Does anyone know how to use transforms.conf to convert these to the real characters in the left column at index time?

[somesoni2]

Add this in your sourcetype definition (props.conf)

[yoursourcetype]
...
..other configs..
...
SEDCMD-specialchars1 = s/specialcodeInxml/replacementcode/g

You need to add one entry for each special character replacement.
e.g.

  for &
        SEDCMD-specialchars5 = s/&/\&/g
  for others
        SEDCMD-specialchars3 = s/"/"/g
        SEDCMD-specialchars4 = s/'/'/g

For more details see this documentation-
http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Anonymizedatausingconfigurationfiles

search for "Anonymize data through a sed script"