About adzeh

adzeh · ‎09-21-2020

Wouldn’t this approach mean after the spath each field name would have all the whole heiarchy in the field name? That would be huge after a lot of values and if a field exists in one log that doesn’t exist in another then that changes thr heiarchy and the field names won’t match.

adzeh · ‎09-21-2020

This approach works but it creates a massive amount of events with no relation to each other, Eg tabling will have null on other fields as they are no longer in the same event.

adzeh · ‎09-21-2020

Do you know of anything that can replace the mvmap command? It’s not in my version of Splunk.

adzeh · ‎08-26-2020

Afternoon all, I have an XML dataset that I am struggling to extract fields from. What I need is for the <key> value to be the field name and the <value> to be the value of that field. For example: BLAdets.Bladetsmeta.FIELD_1="this is the value of field 1": <BLAdets> <Bladetsmeta> <Metadata><Key>FIELD_1</Key><Label>FIELD 1 test</Label><Value>this is the value of field 1</Value></Metadata> <Metadata><Key>FIELD_2</Key><Label>FIELD 2 test</Label><Value>this is the value of field 2</Value></Metadata> <Metadata><Key>FIELD_3</Key><Label>FIELD 3 test </Label><Value>this is the value of field 3</Value></Metadata> </Bladetsmeta> </BLAdets> I have tried xmlkv but it creates a key field with value FIELD_1. Any ideas would be much appreciated. Thanks.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-26-2020

Online Status	Offline
Date Last Visited	‎09-21-2020 06:12 AM

Need help extracting fields from an XML dataset.

Re: XML parsing question

Re: XML parsing question

Re: XML parsing question

Need help extracting fields from an XML dataset.

Are you a member of the Splunk Community?

Need help extracting fields from an XML dataset.

Re: XML parsing question

Re: XML parsing question

Re: XML parsing question

Need help extracting fields from an XML dataset.