Splunk Search

How to configure Splunk to extract fields from XML tags?

rtestu_splunk
Splunk Employee
Splunk Employee

Hi!

I know there are many topics on XML field extractions, but did not see one that matches my requirement!

I receive XML events from a JMS queue (Active MQ) and the raw event in Splunk looks like that :

Thu Feb 25 19:20:14 CET 2016 name=QUEUE_msg_received event_id=ID:rtestu-mbair15-56318-1456424165985-1:6:1:1:1 msg_dest=queue.name msg_body=<typ:Reservation xmlns:typ="http://services.talend.org/reservation/types">
        <reservationId>376121286</reservationId>
        <customer>
            <city>Vegas</city>
            <email>…..

So, there are several key / value pairs that match the different JMS metadata (queue name, etc.) and the last one (msg_body) is the business payload, in XML.

I would like Splunk to automatically extract the XML tags as fields. Is it possible ?

I can't use kv_mode=xml since the event is only partially in XML.
Is there a way to specify that a field is an XML field so that Splunk could parse it and extract the tags?

By the way, I managed to do it via a search, but would like to be able to do it via configuration to simplify all the searches.

Thanks !
Romain.

0 Karma
1 Solution

rtestu_splunk
Splunk Employee
Splunk Employee

That's exactly what I needed. Just tried and it works.
Apparently, I did not search enough ... 😞

Thanks a lot !
Romain.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...