Security

How to extract values from xml tags in log file

nutharsh
New Member

I was wondering how can i extract the values from a particular xml tag in my log file to plot a chart. Every 10 seconds, i am going to push something like <count>15</count> into the log file. The value inside the <count> tag differs every time, i write to the log file. I want Splunk to index such data. How can i extract those changing values from log file and plot a graph using splunk search language.

Tags (1)
0 Karma

Ayn
Legend

Use xmlkv to get the values: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xmlkv

Then use table or timechart to plot your values. If you choose to go for the timechart option, keep in mind that it operates on timespans so you need to feed it with some statistical function to tell it how to handle any events where multiple values show up in a timespan. For instance you could use avg to just get the average in the unlikely event that two values show up in the same span. More info on timechart: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...