Splunk Search

How do you extract the following XML fields?

Rajkumarkbm2
Explorer

Hello,

I need to extract the fields from the below xml. Please help me on this. I want to extract fields from event and then from Status.

alt text

0 Karma

JDukeSplunk
Builder
0 Karma

Rajkumarkbm2
Explorer

Yes tried but not able to split properly

0 Karma

Sukisen1981
Champion

Hi,
What happens when you sort of just append |xmlkv to your index? I know you said that it does not work, but what do you see? Are no fields getting extracted or the fields you want are not getting auto extracted in the left hand side?
The snapshot you have given , is that a raw event as in looks in your splunk xml index right now? If yes, is there any harm in using regex to extract the fields you want from the raw events?

Regards,
Suki

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...