Getting Data In

How does xmlkv work?

Zambonilli
Explorer

All of our data is in XML format that is being indexed. I've been able to pull out a lot of extractions for single value attributes or element values.

However I've yet to be able to figure out how to deal with multivalue xpaths. I've tried using xmlkv but there is little to no documentation in the Splunk documentation and answers.splunk.com.

IE:

<a>1</a><a>2</a><a>3</a>

I want a field or fields pulled out with a certain name for the values 1,2 and 3. xmlkv doesn't seem to do anything. How can I get the values 1,2 and 3 pulled out into a field?

Labels (1)
Tags (2)
2 Solutions

southeringtonp
Motivator

xmlkv looks for values inside tags of the form <fieldname>value</fieldname>. Each time it finds that pattern it sets an extracted field to that value.

If there are multiple keys with the same name, the value of the last one will be used. Note that value may be an empty string, in which case the field will be set to null and may not appear in the list.

For your example, you should see an additional field in the field picker named a, containing a value of 3.


xmlkv is actually a python-based command in the search app, so you can look at the source code in apps/search/bin/xmlkv.py if you're so inclined.

View solution in original post

Lowell
Super Champion

To add to what sotheringtop said, you can aways make a copy of the "xmlkv.py" script and make it multi-value aware so that "a" is returned as a muli-value field that contains [ 1, 2, 3 ].

But on second thought, it may be easier to just do this with a transformer like so:

[xmlkv_multivalue]
REGEX = <(.*?)(?:\s[^>]*)?>([^<]*)</\\1>
FORMAT = $1::$2
MV_ADD = true

So instead of adding | xmlkv to you search, add | extract xmlkv_multivalue and see if that gets you what you want.

View solution in original post

scombs
Path Finder

|spath handles both JSON and XML.

|makeresults |eval _raw="<a>1</a><a>2</a><a>3</a>" |spath path=a output=a

...or just

|makeresults  |eval _raw="<a>1</a><a>2</a><a>3</a>" |spath

 

0 Karma

Lowell
Super Champion

To add to what sotheringtop said, you can aways make a copy of the "xmlkv.py" script and make it multi-value aware so that "a" is returned as a muli-value field that contains [ 1, 2, 3 ].

But on second thought, it may be easier to just do this with a transformer like so:

[xmlkv_multivalue]
REGEX = <(.*?)(?:\s[^>]*)?>([^<]*)</\\1>
FORMAT = $1::$2
MV_ADD = true

So instead of adding | xmlkv to you search, add | extract xmlkv_multivalue and see if that gets you what you want.

southeringtonp
Motivator

Agreed - this is a better way.

0 Karma

Zambonilli
Explorer

Thank you for responding so quickly and with fantastic descriptions.

At this point I've extracted the parent element of the "a" elements and do searches with preceding and trailing *.

0 Karma

southeringtonp
Motivator

xmlkv looks for values inside tags of the form <fieldname>value</fieldname>. Each time it finds that pattern it sets an extracted field to that value.

If there are multiple keys with the same name, the value of the last one will be used. Note that value may be an empty string, in which case the field will be set to null and may not appear in the list.

For your example, you should see an additional field in the field picker named a, containing a value of 3.


xmlkv is actually a python-based command in the search app, so you can look at the source code in apps/search/bin/xmlkv.py if you're so inclined.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...