How to extract values from xml tags in log file

[nutharsh]

I was wondering how can i extract the values from a particular xml tag in my log file to plot a chart. Every 10 seconds, i am going to push something like <count>15</count> into the log file. The value inside the <count> tag differs every time, i write to the log file. I want Splunk to index such data. How can i extract those changing values from log file and plot a graph using splunk search language.

[Ayn]

Use xmlkv to get the values: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xmlkv

Then use table or timechart to plot your values. If you choose to go for the timechart option, keep in mind that it operates on timespans so you need to feed it with some statistical function to tell it how to handle any events where multiple values show up in a timespan. For instance you could use avg to just get the average in the unlikely event that two values show up in the same span. More info on timechart: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart