Splunk Search

Simplifying event displays

rdb_splunk
Explorer

Hi there,

I have XML logs that I bring into spunk. Unfortunately, there is far too much not required information for me to go through,

eg, an event will contain,

2 12/12/12 3:53:39.945 PM
2012.12.12 20:53:39.945 GMT1355345619945America/New_York02012.12.12 20:53:39.945 GMT135534561994546985burl-cap28996AvidLicenseServiceFINERDoing Overdue Cleanup task...42Overdue Cleanup Threadcom.avid.workgroup.license.service.provider.behaviorcom.avid.workgroup.license.service.provider.behavior.LicenseRequest$OverdueCleanupTaskrun

I really want to filter it down to

2012.12.12 20:53:39.945 GMTburl-cap2AvidLicenseServiceFINERDoing Overdue Cleanup task...<com.avid.workgroup.license.service.provider.behaviorcom.avid.workgroup.license.service.provider.behavior.LicenseRequest$OverdueCleanupTask<

As you can see, a lot less detail.

Anyone have any ideas - thanks

Tags (1)
0 Karma

Ayn
Legend

If you're just doing this because you want to browse through events more easily and don't want to actually lose any data, another route you could take is to extract the XML values to fields (have a look at the xmlkv and spath commands), and then use table to show only the fields in the XML events that you're interested in.

jonuwz
Influencer

Yep.

You can write a sed filter to alter the event before its indexed.
I assume this is what you want.
DISCLAIMER - the original event is lost for good, you can't get back the data you strip out.

Put this in your props.conf under a stanza that represents this sourcetype/source/whatever

change 'date|hostname|level|message' to be the list of fields you want to keep.

SEDCMD-reduce_xml = s/(?:(?!<record>)<((?!(?:date|hostname|level|message)>)[^>]+)>.*?<\/\1>)|<\/?record>//g

You'll need to restart splunk for the change to take effect

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...