Splunk Search

How to extract XML field data using transforms.conf?

srinathd
Contributor

How to extract xml data contained in AUDDET_STR field in the following event using transforms.conf settings?

"2016-04-17 12:04:38:935" REC_TS="2016-04-17 12:04:38:935", USERID="sysadmin", AUDTENTRYSEQNUM="0", AUDTSEQNUM="1", DATASRC="NONE", AUDTENTRYTYP="OBEY", SRVCID="DA", AUDDET_STR="<Audit_loggingRq><Timestamp>2016-04-17T12:23:38.93533Z</Timestamp><ContextDescr>SECURE-DA</ContextDescr><Ticket><UserID>SysAdmin</UserID><SessionNumber>1</SessionNumber><TerminalID>dci.exe#529</TerminalID></Ticket><ErrorData>OK</ErrorData><ActivityGroup><ActivityType>OB</ActivityType><TableGroup><TableName>NONE</TableName></TableGroup><KeyGroup><Key><KeyColumn><ColumnName>RowCount</ColumnName><Value>0</Value></KeyColumn></Key></KeyGroup></ActivityGroup></Audit_loggingRq>"
0 Karma

sundareshr
Legend

You could try with field transformation

http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Createandmaintainsearch-timefieldextract...

Add the following to your transform
REGEX = <(\w+)>([^<]+)
FORMAT = $1::$2
MV_ADD = true

With this, if a the same field appears more than once, it will get added as a multi-value field and you can use the multivalue functions in your search

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Parsemultivaluefields

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...