Splunk Search

How do I extract key value pairs from a field in a log file that has XML content?

Contributor

Hi All,

I have log file which has XML content in one of the fields and I need to extract its key value pairs. Can you please help me on this?

Please provide me any examples.

Thanks
Sathish Rangan

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi, you can use the spath command for that:

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

See the examples there

View solution in original post

SplunkTrust
SplunkTrust

Hi, you can use the spath command for that:

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Spath

See the examples there

View solution in original post

Contributor

Thank you javiergn. it is great help..

Is that can be done in the index time using props/trans conifg instead of search query ?

0 Karma

SplunkTrust
SplunkTrust

Not sure what you mean by that. Multiple fields as in different field names or multiple values per field?
Can you give me an example? If you post your XML and the result you are expecting it might be easier.

Short answer anyway: yes you can extract multiple field names from your XML and also multivalue fields (see this)

0 Karma

Contributor

can we extract multiple fileds ??

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!