Splunk Search

How to extract XML out of a native log structure?



I'm looking for a solution to extract xml out of standard logs on order to perform some xpath.
I cannot use rex as I do need to extract values having same tag names in different subtrees.

index="index" sourcetype="sourcetype" xml_2=* | xpath field=test1 "//Metadata/" | table test1 

is showing no result.

How to make Splunk extract xml out of native log structure?


You should use field and outfield for xpath as given below.

<Your Base Search>
| xpath field=xml_2 outfield=test1 "//Metadata"
| table test1, xml2

Alternatively you can also try the spath command

<Your Base Search>
| spath input=xml_2 path="Metadata" output=test1
| table test1

For reference

| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Revered Legend

For xpath to work, the field test1 should have the xml portion, does it? Also, would be much simpler to provide suggestions if you could share some sample events.

0 Karma