XML parsing and field mapping

[panwarsagar]

Hi,

I have a XML file which i wants to load in Splunk and parse during indexing.

<measType p="1">node_cpu.idle</measType>
<measType p="2">node_cpu.iowait</measType>
<measType p="3">node_cpu.irq</measType>
<measType p="4">node_cpu.nice</measType>
<measType p="5">node_cpu.softirq</measType>
<measType p="6">node_cpu.steal</measType>
<measType p="7">node_cpu.system</measType>
<measType p="8">node_cpu.user</measType>
<measValue measObjLdn="host=xxxxxxxx-auxiliary-0,platform=1,cpu=0,instance=xxxxxxx-auxiliary-0:8001,job=node">
<r p="1">4366091.08</r>
<r p="2">27479.68</r>
<r p="3">0</r>
<r p="4">479</r>
<r p="5">18939.5</r>
<r p="6">1157.43</r>
<r p="7">73459.64</r>
<r p="8">64291.39</r>
</measValue>

This has the measType p1.....p8 and value in measValue  p1.....p8. I would like to create field like 

node_cpu.idle=4366091.08

node_cpu.iowait=27479.68 and so on.

Could you please guide how I can achieve this using props.conf anf transforms.conf settings 

[to4kawa]

index=_internal | head 1 | fields _raw
| eval _raw="<measType p=\"1\">node_cpu.idle</measType>
<measType p=\"2\">node_cpu.iowait</measType>
<measType p=\"3\">node_cpu.irq</measType>
<measType p=\"4\">node_cpu.nice</measType>
<measType p=\"5\">node_cpu.softirq</measType>
<measType p=\"6\">node_cpu.steal</measType>
<measType p=\"7\">node_cpu.system</measType>
<measType p=\"8\">node_cpu.user</measType>
<measValue measObjLdn=\"host=xxxxxxxx-auxiliary-0,platform=1,cpu=0,instance=xxxxxxx-auxiliary-0:8001,job=node\">
<r p=\"1\">4366091.08</r>
<r p=\"2\">27479.68</r>
<r p=\"3\">0</r>
<r p=\"4\">479</r>
<r p=\"5\">18939.5</r>
<r p=\"6\">1157.43</r>
<r p=\"7\">73459.64</r>
<r p=\"8\">64291.39</r>
</measValue>"
| spath
| eval type=mvzip(measType,'measType{@p}'), value=mvzip('measValue.r','measValue.r{@p}'), tmp=mvzip(type,value)
| rename measValue{@measObjLdn} as objLdn
| stats values(objLdn) as objLdn by tmp
| rex field=tmp "(?<type>[\w.]+),(?<type_p>\d),(?<value>[\w.]+),(?<value_p>\d)"
| eval {type}=value
| stats values(node_*) as node_* by objLdn
| rename objLdn as _raw
| kv

If you can extract the fields in props.conf, you should be able to get by with transforms.conf.

[to4kawa]

https://community.splunk.com/t5/Getting-Data-In/How-to-configure-XML-data-parsing/m-p/279706

[panwarsagar]

Sorry to say this doesn't provide solution to my problem.