Splunk Search

xml search time extraction not working

Explorer

Hi, I am trying to extract the field tags and values between the interceptor and \Interceptor tags but am not able to, a sample of the xml is below,

<Interceptor>
<AttackCoords>-80.24185962413824,25.24598123976225</AttackCoords>
<Outcome>Interdiction</Outcome>
<Infiltrators>5</Infiltrators>
<Enforcer>Baleineau</Enforcer>
<ActionDate>2013-07-05</ActionDate>
<ActionTime>06:15:00</ActionTime>
<RecordNotes>
Infiltrators: Izar Carrillo, Bartolo Gracia, Xevera Lerma, Flaca Santiago, Xaviera Villalpando
</RecordNotes>
<NumEscaped>0</NumEscaped>
<LaunchCoords/>
<AttackVessel>Raft</AttackVessel>
</Interceptor>

my props.conf and transforms.conf looks like the following

[dreamcrusher]
BREAK_ONLY_BEFORE =
DATETIME_CONFIG =
NO_BINARY_CHECK = true
category = Custom
pulldown_type = true
PREAMBLE_REGEX = (<\?xml.*||<.*dataroot>)
SEDCMD-dr = s/<\/dataroot>//g
TIME_FORMAT = %Y-%m-%d%n%H:%M:%S
TIME_PREFIX =
MAX_DAYS_AGO = 5000
REPORT-fieldvalues = field
disabled = false
LINE_BREAKER =
TRUNCATE =

[field]
CLEAN_KEYS = 0
REGEX = <(\w+)>([^<]+)
FORMAT=$1::$2
MV_ADD = true

upon ingesting the event data, I can not see any search time fields being extracted and i am not sure where I am going wrong, gone through many similar posts and have tried a few things but no luck unfortunately, am i doing something incorrect with my props and transform conf files? please do enlighten me!

Any help would be greatly appreciated!

0 Karma

Champion

Hi,

Are you using single instance or distributed environment? Where you are putting props and transforms?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!