Splunk Search

How do you extract the following XML fields?

Rajkumarkbm2
Explorer

Hello,

I need to extract the fields from the below xml. Please help me on this. I want to extract fields from event and then from Status.

alt text

0 Karma

JDukeSplunk
Builder
0 Karma

Rajkumarkbm2
Explorer

Yes tried but not able to split properly

0 Karma

Sukisen1981
Champion

Hi,
What happens when you sort of just append |xmlkv to your index? I know you said that it does not work, but what do you see? Are no fields getting extracted or the fields you want are not getting auto extracted in the left hand side?
The snapshot you have given , is that a raw event as in looks in your splunk xml index right now? If yes, is there any harm in using regex to extract the fields you want from the raw events?

Regards,
Suki

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26   With threats moving at machine speed and attack surfaces expanding across hybrid ...