Splunk Search

How to write a search for my XML logs?

amanavohra
New Member

I have xml logs as below where I am trying to write a Splunk search to do a search where entry=01 and result = Done

<?xml version="1.0" encoding="utf-16"?>
<transaction name="test" version="1">
    <request>
        <id>123</id>
        <entry>01</entry>
    </request>
</transaction>
<?xml version="1.0" encoding="utf-16"?>
<transaction name="test" version="1">
    <response type="valid">
        <result>WIP</result>
</transaction>
<?xml version="1.0" encoding="utf-16"?>
<transaction name="test" version="1">
    <request>
        <id>123</id>
        <entry>02</entry>
    </request>
</transaction>
<?xml version="1.0" encoding="utf-16"?>
<transaction name="test" version="1">
    <response type="valid">
        <result>DONE</result>
</transaction>
Tags (2)
0 Karma

harish_ka
Communicator

If you just want to filter the events you can use this,
Index=yourIndex sourcetype=yourSourcetype "01" OR "DONE"

The above query will filter the events and display only events having entry=01 and result = Done.
Let me know if you are expecting a different answer...

0 Karma

somesoni2
Revered Legend

Do you get each <transaction> block as separate event?

0 Karma

amanavohra
New Member

Yes, each <transaction> block is a separate event

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

&#x1f48c;Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...