Splunk Search

Replacing Xml header at search time

DataOrg
Builder

i want to remove the header tag in the xml during search time as it was not properly quoted also, 

please help with the command

Have to remove this tag from data durring search time 

   <?xml version=1.0 encoding=utf-8?>

@kamlesh_vaghela 

 

<?xml version=1.0 encoding=utf-8?><Material><ID>1</ID><Equip>001</Equip><Date>20201009</Date><Posting>20201009</Posting>

 

Labels (1)
Tags (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/\sxmlns(|:\w+)=[^\s\>]+//g"

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hello @DataOrg 

You can have your required part of data during search time by adding below configuration in props.conf.

[YouR_stanZa]
EXTRACT-myData = ^[^>\n]*>(?P<myData>.+)

 

If in case you want it to be at index time you can use below configuration also.

[YouR_stanZa]
SEDCMD-a=s/(^[^>\n]*>)//g

 

I hope this will help you.  🙂

Please let me know if you have some special scenario. 

Happy Splunking

🙂 

 

 

 

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw _time | eval _raw="<?xml version=1.0 encoding=utf-8?><Material><ID>1</ID><Equip>001</Equip><Date>20201009</Date><Posting>20201009</Posting>" | xmlkv

how about this?

0 Karma

DataOrg
Builder

I dont need transformation, i just need to remove the header

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That's what the mode=sed does in my response

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/\<\?xml version=1\.0 encoding=utf-8\?\>//g"
0 Karma

DataOrg
Builder

i need to remove only the xml header but i need the <ProductionPerformance> tag
< xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:Extended=http://www.wbf.org/xml/B2MML-V0401-AllExtensions xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xmlns=http://www.wbf.org/xml/B2MML-V0401>

 

<ProductionPerformance xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:Extended=http://www.wbf.org/xml/B2MML-V0401-AllExtensions xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xmlns=http://www.wbf.org/xml/B2MML-V0401>

 

0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw _time | eval _raw="<ProductionPerformance xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:Extended=http://www.wbf.org/xml/B2MML-V0401-AllExtensions xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xmlns=http://www.wbf.org/xml/B2MML-V0401>"
| rex mode=sed "s/xmlns.*>/>/"

DataOrg
Builder

@to4kawa it removes other upcoming data tags also, i just want to remove xmls content from the <ProductionPerformance> tag

Input event:

<EventData><ProductionPerformance xmlns:xsd=http://www.w3.org/2001/XMLSchema xmlns:Extended=http://www.wbf.org/xml/B2MML-V0401-AllExtensions xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xmlns=http://www.wbf.org/xml/B2MML-V0401></ProductionPerformance>
<date>21/1/2020</date>
<Message>Hello</Message>
</EventData>

 

Output i want as 

<EventData><ProductionPerformance></ProductionPerformance>
<date>21/1/2020</date>
<Message>Hello</Message>
</EventData>
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex mode=sed "s/\sxmlns(|:\w+)=[^\s\>]+//g"
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...