Extract xml

[vasanthmss]

Hi Splunkers,

I would like to extract the following xml while indexing..

fields:

host=0.0.0.1
source=mysource
sourcetype=mysourcetype
name=vasu
address=us

xml:

<customvalues>
    <customvalue>
        <name>host</name>
        <value>0.0.0.1</value>      
    </customvalue>
    <customvalue>
        <name>source</name>
        <value>mysource</value>     
    </customvalue>
    <customvalue>
        <name>sourcetype</name>
        <value>mysourcetype</value>     
    </customvalue>
    <customvalue>
        <name>name</name>
        <value>vasu</value>     
    </customvalue>
    <customvalue>
        <name>address</name>
        <value>US</value>       
    </customvalue>
</customvalues>

[splunker12er]

You can take a look at this link

http://answers.splunk.com/answers/152941/windows-how-to-monitor-xml-files-within-a-sub-directory.htm...

[martin_mueller · Accepted solution]

You could set this in props.conf for that sourcetype:

SEDCMD-foo = s/(?s).*?<name>([^<]+).*?<value>([^<]+)(\s*<\/[^>]+>)*/\1="\2" /g

That'll turn your event into this at index time:

host="0.0.0.1" source="mysource" sourcetype="mysourcetype" name="vasu" address="US" 

Note, this will not set Splunk's metadata fields host, source, sourcetype automatically - that requires a bit more rewriting in transforms.conf if that's what you're after.

Note, your closing tags aren't valid XML... also, this kind of data structure sucks to work with.

[vasanthmss]

Thanks Martin_Muller,

actually its my mistake, now changed the question with proper tags,I will give a try and update it.