Loop through XML Child Elements and Concatenate

[bansi]

We use Log4J log file which is fed as input to Splunk. Each entry in the XML file is XML object with timestamp.

Our requirement is to write a search the Log file and extract key fields and then use Splunk Build Report feature to Export CSV file

The challenge is to get the Child Elements of a XML Node and then concatenate them with comma delimiter.

For example here is the entry from log file

2010-11-17 12:59:24,617 [main] DEBUG splunk - marshallObjectToXml; <?xml version="1.0" encoding="UTF-8" standalone="yes"?><EventLogData xmlns="http:/xyz/EventLogData"><Data screen-name="ScottTiger"><DataNode node-type="Contract">
<Elements>
                    <Name name-type="Name">true</Name>
    <DateOfBirth>true</DateOfBirth>         <PhoneNo>true</PhoneNo  
</Elements>


</DataNode></Data></EventLogData>

Wondering if Splunk provides a way how to write a search query which will result in following output

Name, DateOfBirth,PhoneNo

[ziegfried]

First you have to extract those values you're interested in. This can be done either through xpath or the rex command. Using a search like this, would bring the results in tabular form that can be exported:

sourcetype=<your sourcetype> 
| rex "(?m)\<Name[^\>]*>(?<Name>[^\<]+)\</Name\>.*\<DateOfBirth[^\>]*>(?<DateOfBirth>[^\<]+)\</DateOfBirth\>.*\<PhoneNo[^\>]*>(?<PhoneNo>[^\<]+)\</PhoneNo\>"
| table Name DateOfBirth PhoneNo

[bansi]

Hi Ziegfried,
Thanks for your response. I tried your rex command and the search result displays the values under those tag elements whereas my requirement is to extract tag names and not the values under those tag elements.
Please note tag names are dynamic in nature i.e. one xml might have tag names : "Name DateOfBirth PhoneNo" whereas other xml might have tag names :"Gender Name PhoneNo"
Once i retrieve the list of tag names under tag , i have to concatenate theses tag names with comma separated.
For example my search query should return ouput as
Name, DateOfBirth, PhoneNo