Splunk Search

How can I extract these XML values and table them?

kaushik1218
New Member

For example below is my XML

<serviceType>xxx</serviceType>
<some stuff>
<some more stuff>
<code>D</code>

Now I need above thing "xxx" as field to the value "D" to be extracted and displayed as below in table format

xxx
D

Can someone please help me here. Thanks in advance

0 Karma
1 Solution

azamir_splunk
Splunk Employee
Splunk Employee

You can try using KV_MODE = XML in props.conf or use the SPATH command, you can also create a REGEX rule in transforms.conf, depending on what is easier for you to do.

Hope this helps.

View solution in original post

0 Karma

azamir_splunk
Splunk Employee
Splunk Employee

You can try using KV_MODE = XML in props.conf or use the SPATH command, you can also create a REGEX rule in transforms.conf, depending on what is easier for you to do.

Hope this helps.

0 Karma

kaushik1218
New Member

Thanks for your response 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...