Getting Data In

XML tags extraction at index time



I am trying to create some fields at index time from an XML log.

I prepared the sourcetype definition in the props.conf with the related TRANSFORM, and in the the transforms.conf I have the following:


FORMAT = $1::$2

REGEX = <email>(.*?)<\/email><ccard>(.*?)<\/ccard><company>(.*?)<\/company><city>(.*?)<\/city>
FORMAT = email::"$1" credit_card::"$2" company::"$3" city::"$4"


 and this my sample event:


<email></email><ccard>4539599637112700</ccard><city>Hamilton</city><company>Eros Proin LLC</company></fst>


 Now, the problem is, if I use the first transform, only the email field is extracted (by the way I tried the regex in regex101 site and it worked with all the fields). If I use the second transform, everything is ok.

Is there some limitation in the index-time field extraction about the "generic" xml tags extraction?



Labels (4)
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...