Splunk Search

Can I get field extraction for XML data that is a data field in a JSON event?

wfrankl2
Explorer

I have event data coming into Splunk as JSON, that's all fine and works great, but one of the fields they are going to use is XML. Is there a way to get the XML field extracted from that? Right now it puts the XML as the value in a data field, but they want to search on values in the XML.

snippet

ThreadId:  9 
    TransactionDataXML:  <TransactionDataXML><Input><Extensions><SourceSystem>application</SourceSystem></Extensions></Input><Output><StorePolicyPacketServiceResponse><ResponseCode>0</ResponseCode><ResponseDetails><TransactionId>091ef6c7-7d6b-4374-ac6b-8ec67abc6a96</TransactionId><ElapsedTime>30080</ElapsedTime><MachineId>server</MachineId><OriginalRequest><Extensions><SourceSystem>application</SourceSystem></Extensions></OriginalRequest></ResponseDetails></StorePolicyPacketServiceResponse></Output></TransactionDataXML> 
    TransactionDateTime:  2016-01-28T14:38:36.729986-05:00 
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this (run anywhere sample)

| gentimes start=-1 | eval _raw="{
    \"LogName\": \"ExampleLog\",
    \"CorrelationId\": \"f879095a-0109-4235-8ba8-218f43f27220\",
    \"LoggingLevel\": \"All\",
    \"ThreadId\": \"9\",
    \"LocalTimeStamp\": \"2016-01-28T14:38:36.748986-05:00\",
    \"AccessModeName\": \"ABC\",
    \"AgentCode\": \"00000\",
    \"AgentPrefixCode\": \"CA\",
    \"ApplicationName\": \"UQ\",
    \"ChannelCode\": \"DI\",
    \"CIFCommonSchemaVersionNbr\": \"V0200\",
    \"CIFGeneratedSchemaId\": \"05c0b8a4-2954-4fb7-a6ae-def569bd4b63\",
    \"CIFSoftwareVersionNbr\": \"1.2\",
    \"DataCenterLocationText\": \"None\",
    \"InstrumentationLogDateTime\": \"/Date(1454070556298)/\",
    \"LoggingComputerSystemName\": \"mycomputer\",
    \"LoggingLevelName\": \"Critical\",
    \"MessageText\": \"Hello world\",
    \"OperatingEnvironmentName\": \"Development\",
    \"PartyLogonIdTypeName\": \"None\",
    \"TransactionDataXML\": \"<application><GUID>0091ef6c7-7d6b-4374-ac6b-8ec67abc6a9630080</GUID><name>Test</name></application>\",
    \"TransactionDateTime\": \"2016-01-28T14:38:36.729986-05:00\",
    \"CIFSchemaValidationErrors\": [
        \"AccessModeName should be 10 characters\"
    ],
    \"CIFSchemaValidated\": true,
    \"Custom1\": \"Custom1Value\",
    \"EventId\": 0,
    \"CIFUniqueMessageId\": \"f879095a-0109-4235-8ba8-218f43f27220\"
}" | table _raw | spath| spath input=TransactionDataXML

alemarzu
Motivator
0 Karma

wfrankl2
Explorer

I will check it out. I tried to give a snippet of the code but it removed all formatting. I will give it another try.

{"LogName":"ExampleLog","CorrelationId":"f879095a-0109-4235-8ba8-218f43f27220","LoggingLevel":"All","ThreadId":"9","LocalTimeStamp":"2016-01-28T14:38:36.748986-05:00","AccessModeName":"ABC","AgentCode":"00000","AgentPrefixCode":"CA","ApplicationName":"UQ","ChannelCode":"DI","CIFCommonSchemaVersionNbr":"V0200","CIFGeneratedSchemaId":"05c0b8a4-2954-4fb7-a6ae-def569bd4b63","CIFSoftwareVersionNbr":"1.2","DataCenterLocationText":"None","InstrumentationLogDateTime":"/Date(1454070556298)/","LoggingComputerSystemName":"mycomputer","LoggingLevelName":"Critical","MessageText":"Hello world","OperatingEnvironmentName":"Development","PartyLogonIdTypeName":"None","TransactionDataXML":"application0091ef6c7-7d6b-4374-ac6b-8ec67abc6a9630080serverapplication","TransactionDateTime":"2016-01-28T14:38:36.729986-05:00","CIFSchemaValidationErrors":["AccessModeName should be 10 characters"],"CIFSchemaValidated":true,"Custom1":"Custom1Value","EventId":0,"CIFUniqueMessageId":"f879095a-0109-4235-8ba8-218f43f27220"}
0 Karma

wfrankl2
Explorer

It removes my xml formatting when I paste it in. the TransactiondataXML is the field where the data would be.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...