Hey Friends
I'm having a lot of issues importing an XML file to my Splunk Enterprise. Actually, I'm a new user to Splunk and still trying without success inthis xml file.
Googling around, I figured out that the right file to configuring this parsing should be props.conf, but I already tried to make some changes and configurations inside props.conf, but didn't see a way to do it right.
Indeed, this file is a result from a NetScan and I'm not getting how to configure this property.
Could you guys give me a little help?
Below you can see a sample of file that I'm trying to parse. Pay attention that when this scan found additional information regarding share to specific device, this also insert as a parameter for folder, and, unfortunately we cannot change the way that this report is issued.
<?xml version="1.0"?>
<network-scanner-result>
<summary>
<title>Network Scanner</title>
<range></range>
<date>2016-02-01T13:14:51.570-02:00</date>
</summary>
<devices>
<item>
<ip-address>10.77.4.57</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>1</response-time>
</item>
<item>
<ip-address>10.77.4.58</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>0</response-time>
</item>
<item>
<ip-address>10.77.4.61</ip-address>
<folders>
<item>
<name>MPC3001</name>
<attr>printer</attr>
</item>
<item>
<name>IPC$</name>
<attr>ipc</attr>
</item>
</folders>
<hostname>RNP002673377C09</hostname>
<mac-address>002673377C09</mac-address>
<response-time>8</response-time>
</item>
<item>
<ip-address>10.77.4.90</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>0</response-time>
</item>
<item>
<ip-address>10.77.4.91</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>2</response-time>
</item>
<item>
<ip-address>10.77.4.92</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>0</response-time>
</item>
<item>
<ip-address>10.77.4.93</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>1</response-time>
</item>
<item>
<ip-address>10.77.4.94</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>0</response-time>
</item>
<item>
<ip-address>10.77.4.95</ip-address>
<hostname></hostname>
<mac-address>000000000000</mac-address>
<response-time>5</response-time>
</item>
</devices>
</network-scanner-result>
Could you guys give-me a little help how can I Parse that?
... View more
