I need to extract fields from log which is in xml format.
Below is the example:
<Event> <DateTime>2022-11-10T11:58:41.136Z</DateTime> <IBIC8>CTBAAUSN</IBIC8> <InstanceId>D</InstanceId> <EventCode>PAG.NTF.CRL_UPDATE_SUCCESS</EventCode> <Name>CRL update succeeded</Name> <Severity>INFO</Severity> <Class>SECURITY</Class> <Text><![CDATA[CRL was successfully downloaded and validated Context: - URL: https://crlcheck.common.sipn.swift.com:443/SWIFTCA1.crl - Version: 2 - Updated on: Thu Nov 10 21:57:53 AEDT 2022 - Valid till: Sun Nov 13 21:57:53 AEDT 2022 - Issuer: o=swift]]></Text> </Event>
I need to extract fields like eventcode,severity,text .
How can i extract it as statistical data either by using regular expression or how it is...or there is any way to extract the, Please suggest
Hi @vineela,
which sourcetype did you used for your data source?
if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.
otherwise you have to use some regexes to extract them:
| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"
that you can test at https://regex101.com/r/ZrYeyg/1
Ciao.
Giuseppe
Hi @vineela,
which sourcetype did you used for your data source?
if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.
otherwise you have to use some regexes to extract them:
| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"
that you can test at https://regex101.com/r/ZrYeyg/1
Ciao.
Giuseppe
Hi @vineela,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉