Can I get field extraction for XML data that is a data field in a JSON event?

[wfrankl2]

I have event data coming into Splunk as JSON, that's all fine and works great, but one of the fields they are going to use is XML. Is there a way to get the XML field extracted from that? Right now it puts the XML as the value in a data field, but they want to search on values in the XML.

snippet

ThreadId:  9 
    TransactionDataXML:  <TransactionDataXML><Input><Extensions><SourceSystem>application</SourceSystem></Extensions></Input><Output><StorePolicyPacketServiceResponse><ResponseCode>0</ResponseCode><ResponseDetails><TransactionId>091ef6c7-7d6b-4374-ac6b-8ec67abc6a96</TransactionId><ElapsedTime>30080</ElapsedTime><MachineId>server</MachineId><OriginalRequest><Extensions><SourceSystem>application</SourceSystem></Extensions></OriginalRequest></ResponseDetails></StorePolicyPacketServiceResponse></Output></TransactionDataXML> 
    TransactionDateTime:  2016-01-28T14:38:36.729986-05:00 

[somesoni2]

Try something like this (run anywhere sample)

| gentimes start=-1 | eval _raw="{
    \"LogName\": \"ExampleLog\",
    \"CorrelationId\": \"f879095a-0109-4235-8ba8-218f43f27220\",
    \"LoggingLevel\": \"All\",
    \"ThreadId\": \"9\",
    \"LocalTimeStamp\": \"2016-01-28T14:38:36.748986-05:00\",
    \"AccessModeName\": \"ABC\",
    \"AgentCode\": \"00000\",
    \"AgentPrefixCode\": \"CA\",
    \"ApplicationName\": \"UQ\",
    \"ChannelCode\": \"DI\",
    \"CIFCommonSchemaVersionNbr\": \"V0200\",
    \"CIFGeneratedSchemaId\": \"05c0b8a4-2954-4fb7-a6ae-def569bd4b63\",
    \"CIFSoftwareVersionNbr\": \"1.2\",
    \"DataCenterLocationText\": \"None\",
    \"InstrumentationLogDateTime\": \"/Date(1454070556298)/\",
    \"LoggingComputerSystemName\": \"mycomputer\",
    \"LoggingLevelName\": \"Critical\",
    \"MessageText\": \"Hello world\",
    \"OperatingEnvironmentName\": \"Development\",
    \"PartyLogonIdTypeName\": \"None\",
    \"TransactionDataXML\": \"<application><GUID>0091ef6c7-7d6b-4374-ac6b-8ec67abc6a9630080</GUID><name>Test</name></application>\",
    \"TransactionDateTime\": \"2016-01-28T14:38:36.729986-05:00\",
    \"CIFSchemaValidationErrors\": [
        \"AccessModeName should be 10 characters\"
    ],
    \"CIFSchemaValidated\": true,
    \"Custom1\": \"Custom1Value\",
    \"EventId\": 0,
    \"CIFUniqueMessageId\": \"f879095a-0109-4235-8ba8-218f43f27220\"
}" | table _raw | spath| spath input=TransactionDataXML

[alemarzu]

Read this,

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

Can you share a sample event ?

[wfrankl2]

I will check it out. I tried to give a snippet of the code but it removed all formatting. I will give it another try.

{"LogName":"ExampleLog","CorrelationId":"f879095a-0109-4235-8ba8-218f43f27220","LoggingLevel":"All","ThreadId":"9","LocalTimeStamp":"2016-01-28T14:38:36.748986-05:00","AccessModeName":"ABC","AgentCode":"00000","AgentPrefixCode":"CA","ApplicationName":"UQ","ChannelCode":"DI","CIFCommonSchemaVersionNbr":"V0200","CIFGeneratedSchemaId":"05c0b8a4-2954-4fb7-a6ae-def569bd4b63","CIFSoftwareVersionNbr":"1.2","DataCenterLocationText":"None","InstrumentationLogDateTime":"/Date(1454070556298)/","LoggingComputerSystemName":"mycomputer","LoggingLevelName":"Critical","MessageText":"Hello world","OperatingEnvironmentName":"Development","PartyLogonIdTypeName":"None","TransactionDataXML":"application0091ef6c7-7d6b-4374-ac6b-8ec67abc6a9630080serverapplication","TransactionDateTime":"2016-01-28T14:38:36.729986-05:00","CIFSchemaValidationErrors":["AccessModeName should be 10 characters"],"CIFSchemaValidated":true,"Custom1":"Custom1Value","EventId":0,"CIFUniqueMessageId":"f879095a-0109-4235-8ba8-218f43f27220"}

[wfrankl2]

It removes my xml formatting when I paste it in. the TransactiondataXML is the field where the data would be.