Getting Data In

not work transforms

klychnikov
Explorer
Based on config files(please see below) we transform file from .xml format to .csv.
After the log been converted we see that all the messages written as one large event.
We would like to have one event per csv’s string with the fields from transforms.conf.

> inputs.conf
> [monitor:\\SPLUNK0\C$\test\1]
> index = kasper
> _whitelist = .*\.xml
> 
> props.conf  [source::...kasper*.xml]
> TRUNCATE =  0 
> SEDCMD-1 = s/(?m)(^.*?</Worksheet>)//g ###clean the garbage
> SEDCMD-2 = s/(?m)(<W\w*\s\w*\SN\w*[="]+M\w*.*>$)//g ####clean the garbage
> SEDCMD-3 = s/(?m)(</R\w*>)/\n/g ###transfer the event to a new line
> SEDCMD-4 = s/(?m)(</D\w*>)/;/g ### set separators
> SEDCMD-5 = s/(?m)(<[^>]*>)//g ### delete tags
> sourcetype = csv_kasper  
> CHECK_FOR_HEADER = false
> priority = 101

> transforms.conf
> [csv_kasper]
> DELIMS=";"
> FIELDS="Status","V-host","Group","Computer","LastData","description","IP","Alive","Domain","NetBIOS","DomainName","DNS"
> 

> Критический;;0_test;BD00;7 ноября 2012 г. 15:17:23;Не установлен Антивирус Касперского. ;10.54.44.68;7 ноября 2012 г. 15:17:23;dom;BD00;bd00;dom;
> Критический;;0_test;BD00;16 ноября 2012 г. 12:01:16;Давно не выполнялся поиск вирусов. ;10.54.45.26;16 ноября 2012 г. 12:01:16;dom;BD00;bd00;dom;
> Критический;;0_test;BEOVA;16 ноября 2012 г. 11:58:35;Давно не выполнялся поиск вирусов. ;10.54.44.70;16 ноября 2012 г. 12:06:28;dom;BEZULOVA;beova;dom;
> Критический;;0_test;BRCH11;16 ноября 2012 г. 11:55:25;Давно не выполнялся поиск вирусов. ;10.54.42.71;16 ноября 2012 г. 11:55:25;dom;BRONICH11;brich11;dom;
Tags (1)
0 Karma
1 Solution

Drainy
Champion

Just in terms of "making your life easy", I would be tempted to write a python script that handles the conversion of XML to CSV and then get Splunk to read in the CSV, that will be relatively simple. Maintaining and using the config above could become an effort over time.

Otherwise, sed isn't my area of specialty sorry 🙂 But I always take the view that I should try and help Splunk out as much as I can to simplify configs and avoid performance hits (if you're indexing a lot)

View solution in original post

klychnikov
Explorer

All events brings in one event. I would like to a breakdown of the items on the events

0 Karma

Drainy
Champion

Well I understood the first part, it may not point out the error but it offers a workaround. The second part, what?

0 Karma

klychnikov
Explorer

Frankly this is not the answer. Ask about a particular situation. Enough time has passed, the last on a week.

0 Karma

Drainy
Champion

What now? If you're saying theres no support you just need to give it time, its a community site so it sometimes takes a while to get an answer

0 Karma

Drainy
Champion

Just in terms of "making your life easy", I would be tempted to write a python script that handles the conversion of XML to CSV and then get Splunk to read in the CSV, that will be relatively simple. Maintaining and using the config above could become an effort over time.

Otherwise, sed isn't my area of specialty sorry 🙂 But I always take the view that I should try and help Splunk out as much as I can to simplify configs and avoid performance hits (if you're indexing a lot)

klychnikov
Explorer

As I understand it is no support! Ask not for the first question and assistance to the no!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...