Why are some fields from XML data not displayed in search results?

[alexandermunce]

When I conduct a generic search on one of our Splunk sources, I am looking for relevant data which will assist with categorizing and analyzing the data.

I noticed that this particular batch of data did not have too many unique identifying fields which were useful for my analysis (eg, customer id, etc).

However, when I took a closer look at some of the results XML data, I could see that there was indeed some relevant identifying data which was contained within tags. For example, for the purpose of this question lets say;

< customer-id >0100000< /customer-id >

(Without the spaces)

I am wondering why this data does not display as a field which I can manipulate/sort by/etc within the search results.

Is this not a valid XML tag which is therefore a field?

[ktugwell_splunk · Accepted solution]

If the data is close it, or is valid XML, Splunk will recognise it and extract the fields. But you usually have to tell splunk that the data is XML.

Your search | xmlkv

This will tell splunk to extract XML fields at search time. This is however not the most efficient way.

You can set this in your sourcetype (props.conf)

[your_sourcetype]
...
KV_MODE = xml 

Give this a try

Thanks

[alexandermunce]

Perfect, thank you kindly!

Looks like there are too many irrelevant fields extracted if I use the xmlkv command, so I think I will have to use the rex command to extract the fields I require!