how to extract xml tag fileds

[mintucs]

after iindesing the xml tags i am getting the as show below
i am getting trouble how extract the data from it

  <IDX_BASE>B1102</IDX_BASE>
  <NOM_BASE>LANDES DE COUESME</NOM_BASE>
  <IDX_EQUIPEMENT>501</IDX_EQUIPEMENT>
  <NOM_EQUIPEMENT>E3</NOM_EQUIPEMENT>
  <DH_CONTROLE>2/6/2018 16:6:4</DH_CONTROLE>
  <ETAT_ALARME>ALM</ETAT_ALARME>
  <AVIS_EXPERT>ACCEPTABLE</AVIS_EXPERT>
  <RESUME_DIAG>MB: chocs \xE9pisodiques</RESUME_DIAG>
  <DETAILS_DIAG>

[TISKAR]

Hello can you try this please:

in the props.conf

[xml2]
DATETIME_CONFIG = 
NO_BINARY_CHECK = 1
category = Structured
pulldown_type = 1
SHOULD_LINEMERGE = true
REPORT-xmlkv = xml_trans2
disabled = false

in your transforms.conf add :

[xml_trans2]
REGEX=<([^>]+)>([^<]+)<\/\1>
FORMAT=$1::$2
MV_ADD = true

[niketn]

@mintucs, your XML Data schema seems incorrect. There should be a root node under which above xml child nodes should be present. If you have xml data in raw events, you can enable KV_MODE=xml in props.conf to have Splunk automatically extract the fields from XML data during search time field discovery.

On similar lines please try the following run anywhere example where | makeresults and | eval _raw pipes generate dummy data as per the question. (PS: I have added <SOMENODE> as root node for the xml to become a valid xml so that spath can work):

| makeresults 
| eval _raw="<SOMENODE>
   <IDX_BASE>B1102</IDX_BASE>
   <NOM_BASE>LANDES DE COUESME</NOM_BASE>
   <IDX_EQUIPEMENT>501</IDX_EQUIPEMENT>
   <NOM_EQUIPEMENT>E3</NOM_EQUIPEMENT>
   <DH_CONTROLE>2/6/2018 16:6:4</DH_CONTROLE>
   <ETAT_ALARME>ALM</ETAT_ALARME>
   <AVIS_EXPERT>ACCEPTABLE</AVIS_EXPERT>
   <RESUME_DIAG>MB: chocs \xE9pisodiques</RESUME_DIAG>
   </SOMENODE>" 
| spath