Splunk Search

How do I extract fields from XML child and leaf nodes?

Path Finder

Hi ,

Splunk is pulling data from URLs , which is having below format:


Here DocumentElement is the root element, CMN_DEPARTMENT is child element and having "sys_id" are leaf nodes. When I extract index, I'm getting only one sys_id out of 5-6 ids under one event. Like this, we will have 24 events per day (i.e. pulling data from URL every one hour).

How to extract each sys_id into index and perform search operations on it?

Thanks in advance.

0 Karma


Maybe try adding KV_MODE = xml in your Search head props.conf?

0 Karma

Splunk Employee
Splunk Employee

Have you tried using the xmlkv command ?

0 Karma

Path Finder

Yes, we tried with xmlkv command & "KV_MODE = xml" in props.conf
We are getting all the results as list basis not in event base means
ex: 0036651c6fffb000c60337c64f3ee4ac




Its whole result comes under one result (showing as list/values command).

I need it as separate events.

0 Karma