Splunk Search

How can we add the first event to all existing event as a matedata?

vikasreddy
Explorer

Here is the case , I have an huge XML file . In which i have extracted the events based on the tags.So i have the 3 tags header, trailer and body . So, the output will be the header section as one event and body was divide into x number of events based on the internal tag and trailer has one event . I need header section to be attached on all the events . How can we do this?

Structure of the xmlalt text

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...