Splunk Search
Highlighted

How can I extract these XML values and table them?

New Member

For example below is my XML

<serviceType>xxx</serviceType>
<some stuff>
<some more stuff>
<code>D</code>

Now I need above thing "xxx" as field to the value "D" to be extracted and displayed as below in table format

xxx
D

Can someone please help me here. Thanks in advance

0 Karma
Highlighted

Re: How can I extract these XML values and table them?

Splunk Employee
Splunk Employee

You can try using KV_MODE = XML in props.conf or use the SPATH command, you can also create a REGEX rule in transforms.conf, depending on what is easier for you to do.

Hope this helps.

View solution in original post

0 Karma
Highlighted

Re: How can I extract these XML values and table them?

New Member

Thanks for your response 🙂

0 Karma