Alerting

How to extract data in xml data format?

vineela
Path Finder

I need to extract fields from log which is in xml format.
Below is the example:

<Event> <DateTime>2022-11-10T11:58:41.136Z</DateTime> <IBIC8>CTBAAUSN</IBIC8> <InstanceId>D</InstanceId> <EventCode>PAG.NTF.CRL_UPDATE_SUCCESS</EventCode> <Name>CRL update succeeded</Name> <Severity>INFO</Severity> <Class>SECURITY</Class> <Text><![CDATA[CRL was successfully downloaded and validated Context: - URL: https://crlcheck.common.sipn.swift.com:443/SWIFTCA1.crl - Version: 2 - Updated on: Thu Nov 10 21:57:53 AEDT 2022 - Valid till: Sun Nov 13 21:57:53 AEDT 2022 - Issuer: o=swift]]></Text> </Event>


I need to extract fields like eventcode,severity,text .

How can i extract it as statistical data either by using regular expression or how it is...or there is any way to extract the, Please suggest

Labels (2)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

 

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

 

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

which sourcetype did you used for your data source?

if you are using one with the option "INDEXED_DATA = xml", you automatically have all the fields in your events.

otherwise you have to use some regexes to extract them:

 

| rex "\<EventCode\>(?<EventCode>[^\<]+).*\<Severity\>(?<Severity>[^\<]+).*<Text>(?<Text>.*)\>\<\/Text\>"

 

that you can test at https://regex101.com/r/ZrYeyg/1

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vineela,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...