How to break xml in search time

[sdaruna]

Hi,

I need to index whole file data into splunk for a reason and i need to break that while searching. I understood and could break it while indexing, using source_type.

But, i need to do it in search time and breaking string could be dynamic. Lets say, i need to break it with <Employee> once and some times with <Department> and etc.

Is there a way to do it using splunk search language.?

[sundareshr]

You can use rex to extract only the nodes you need at search time. If you need assistance with regex, please post sample data and someone in the community will be able to assist. One example of rex would be

... | rex "\<Employee\>(?<emp>.*)\<\/Employee\>"

http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/rex

[sdaruna]

Hi,

rex is working to extract data in between xml tags for me, but i am unable to split content into nodes. please find below xml sample and the rex i tried.

<?xml version="1.0" encoding="UTF-8"?>
<Document xsi:noNamespaceSchemaLocation="EPA_GEODATA_v1.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">   
    <FacilitySite registryId="110007915364">
        <FacilitySiteName>GREAT SOUTHERN WOOD PRESERVING INC</FacilitySiteName>
        <LocationAddressText>1100 HIGHWAY 431 NORTH</LocationAddressText>
        <LocalityName>ABBEVILLE</LocalityName>
        <LocationAddressStateCode>AL</LocationAddressStateCode>
    </FacilitySite>
    <FacilitySite registryId="110000369084">
        <FacilitySiteName>REMBRANDT FOODS- ABBEVILLE</FacilitySiteName>
        <LocationAddressText>496 INDUSTRIAL PARK RD</LocationAddressText>
        <LocalityName>ABBEVILLE</LocalityName>
        <LocationAddressStateCode>AL</LocationAddressStateCode>
        <LocationZIPCode>36310</LocationZIPCode>
    </FacilitySite>
    <FacilitySite registryId="110055437718">
        <FacilitySiteName>RITE AID #7092</FacilitySiteName>
        <LocationAddressText>514 KIRKLAND STREET</LocationAddressText>
        <LocalityName>ABBEVILLE</LocalityName>
        <LocationAddressStateCode>AL</LocationAddressStateCode>
        <LocationZIPCode>36310-2700</LocationZIPCode>
        <LatitudeMeasure>31.56149</LatitudeMeasure>
    </FacilitySite>
</Document>

Rex command i used:

index = "cbb_sample" | rex ".)>(?.)<\/FacilitySite>" | table Node

I want to get three rows out of the above data.

[sundareshr]

Have you tried xmlkv & spath?

http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/xmlkv
http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/spath