Splunk Search

How do I extract key value pairs from a field in a log file that has XML content?

rsathish47
Contributor

Hi All,

I have log file which has XML content in one of the fields and I need to extract its key value pairs. Can you please help me on this?

Please provide me any examples.

Thanks
Sathish Rangan

0 Karma
1 Solution

javiergn
Super Champion

Hi, you can use the spath command for that:

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

See the examples there

View solution in original post

javiergn
Super Champion

Hi, you can use the spath command for that:

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

See the examples there

rsathish47
Contributor

Thank you javiergn. it is great help..

Is that can be done in the index time using props/trans conifg instead of search query ?

0 Karma

javiergn
Super Champion

Not sure what you mean by that. Multiple fields as in different field names or multiple values per field?
Can you give me an example? If you post your XML and the result you are expecting it might be easier.

Short answer anyway: yes you can extract multiple field names from your XML and also multivalue fields (see this)

0 Karma

rsathish47
Contributor

can we extract multiple fileds ??

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...