When I conduct a generic search on one of our Splunk sources, I am looking for relevant data which will assist with categorizing and analyzing the data.
I noticed that this particular batch of data did not have too many unique identifying fields which were useful for my analysis (eg, customer id, etc).
However, when I took a closer look at some of the results XML data, I could see that there was indeed some relevant identifying data which was contained within tags. For example, for the purpose of this question lets say;
< customer-id >0100000< /customer-id >
(Without the spaces)
I am wondering why this data does not display as a field which I can manipulate/sort by/etc within the search results.
Is this not a valid XML tag which is therefore a field?
If the data is close it, or is valid XML, Splunk will recognise it and extract the fields. But you usually have to tell splunk that the data is XML.
Your search | xmlkv
This will tell splunk to extract XML fields at search time. This is however not the most efficient way.
You can set this in your sourcetype (props.conf)
[your_sourcetype]
...
KV_MODE = xml
Give this a try
Thanks
If the data is close it, or is valid XML, Splunk will recognise it and extract the fields. But you usually have to tell splunk that the data is XML.
Your search | xmlkv
This will tell splunk to extract XML fields at search time. This is however not the most efficient way.
You can set this in your sourcetype (props.conf)
[your_sourcetype]
...
KV_MODE = xml
Give this a try
Thanks
Perfect, thank you kindly!
Looks like there are too many irrelevant fields extracted if I use the xmlkv command, so I think I will have to use the rex command to extract the fields I require!