Splunk Search

How to configure Splunk to extract fields from XML tags?

Splunk Employee
Splunk Employee


I know there are many topics on XML field extractions, but did not see one that matches my requirement!

I receive XML events from a JMS queue (Active MQ) and the raw event in Splunk looks like that :

Thu Feb 25 19:20:14 CET 2016 name=QUEUE_msg_received event_id=ID:rtestu-mbair15-56318-1456424165985-1:6:1:1:1 msg_dest=queue.name msg_body=<typ:Reservation xmlns:typ="http://services.talend.org/reservation/types">

So, there are several key / value pairs that match the different JMS metadata (queue name, etc.) and the last one (msg_body) is the business payload, in XML.

I would like Splunk to automatically extract the XML tags as fields. Is it possible ?

I can't use kv_mode=xml since the event is only partially in XML.
Is there a way to specify that a field is an XML field so that Splunk could parse it and extract the tags?

By the way, I managed to do it via a search, but would like to be able to do it via configuration to simplify all the searches.

Thanks !

0 Karma
1 Solution


Splunk Employee
Splunk Employee

That's exactly what I needed. Just tried and it works.
Apparently, I did not search enough ... 😞

Thanks a lot !

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>