Alerting

How to extract data in xml data format?

vineela
Path Finder

I need to extract fields from log which is in xml format.
Below is the example:

<Event> <DateTime>2022-11-10T11:58:41.136Z</DateTime> <IBIC8>CTBAAUSN</IBIC8> <InstanceId>D</InstanceId> <EventCode>PAG.NTF.CRL_UPDATE_SUCCESS</EventCode> <Name>CRL update succeeded</Name> <Severity>INFO</Severity> <Class>SECURITY</Class> <Text><![CDATA[CRL was successfully downloaded and validated Context: - URL: https://crlcheck.common.sipn.swift.com:443/SWIFTCA1.crl - Version: 2 - Updated on: Thu Nov 10 21:57:53 AEDT 2022 - Valid till: Sun Nov 13 21:57:53 AEDT 2022 - Issuer: o=swift]]></Text> </Event>


I need to extract fields like eventcode,severity,text .

How can i extract it as statistical data either by using regular expression or how it is...or there is any way to extract the, Please suggest

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

 

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

 

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
Esteemed Legend

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

 

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

 

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

0 Karma

gcusello
Esteemed Legend

Hi @vineela,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...