XML metadata field extraction

[jsanjeb]

Hi Splunkers,

I am working on field extraction for XML events. I have added regex in transforms.conf for extraction. XML looks like this,

<?xml version="1.0" encoding="UTF-8"?>
<transaction version="6.00" ID="1234" agentRole="sourceAgent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="TransferLog.xsd" xmlns="">
    <field1 time="2018-03-30T19:53:34.472Z">abc</field1>
    <field2 agent="abc" QMgr="abc" agentType="abc">
        <systemInfo architecture="abc" name="abc" version="3.10.0-514.21.2.el7.x86_64"/>
    </field1>
    <field3 agent="abc" QMgr="abc"/>
    <originator>
        <field4>abc</field4>
        <field5>abc</field5>
        <field6>abc</field6>
    </originator>
    <transferSet startTime="2018-03-30T19:53:34.473Z" total="1" bytesSent="0">
        <metaDataSet>
            <metaData key="field7">abc</metaData>
            <metaData key="field8">abc</metaData>
            <metaData key="field9">abc</metaData>
            <metaData key="com.ibm.wmqfte.field10">abc</metaData>
            <metaData key="com.ibm.wmqfte.field11">abc</metaData>
            <metaData key="com.ibm.wmqfte.field12">abc</metaData>           
        </metaDataSet>
    </transferSet>
</transaction>

props.conf

[mft]
category = Custom
pulldown_type = 1
NO_BINARY_CHECK = true
disabled = false
REPORT-xmlkv = xmlkv-alternative

transforms.conf

 [xmlkv-alternative]
 REGEX = <([^\s\>]*)[^\>]*\>([^<]*)\<\/\1\>
 FORMAT = $1::$2

Using the above regex I am able extract tags named field1, field2, field3 field4, field5 and field6 in the XML. However remaining fields inside tag ie field7 to field12 in XML cannot be extracted. Exception here is i need not extract/ ignore all fields in this form com.ibm.wmqfte.field10. Please help me with this extraction.

Thanks

[785978]

I am curios about this as well, i have a similar problem and trying to extract the field name from metadata