Splunk Search

How do I extract key value pairs from a field in a log file that has XML content?

rsathish47
Contributor

Hi All,

I have log file which has XML content in one of the fields and I need to extract its key value pairs. Can you please help me on this?

Please provide me any examples.

Thanks
Sathish Rangan

0 Karma
1 Solution

javiergn
Super Champion

Hi, you can use the spath command for that:

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

See the examples there

View solution in original post

javiergn
Super Champion

Hi, you can use the spath command for that:

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

See the examples there

rsathish47
Contributor

Thank you javiergn. it is great help..

Is that can be done in the index time using props/trans conifg instead of search query ?

0 Karma

javiergn
Super Champion

Not sure what you mean by that. Multiple fields as in different field names or multiple values per field?
Can you give me an example? If you post your XML and the result you are expecting it might be easier.

Short answer anyway: yes you can extract multiple field names from your XML and also multivalue fields (see this)

0 Karma

rsathish47
Contributor

can we extract multiple fileds ??

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...