Dashboards & Visualizations

Collect values from semi-xml log

carljohan
Path Finder

Hi,

I have a logfile with the following syntax:

2011-10-13 09:34:29,309 [-] [HttpClientWorker-9]  INFO LogMediator To: http://www.w3.org/2005/08/addressing/anonymous,WSAction: ,SOAPAction: ,MessageID: urn:uuid:11111111111111111-222222222,Direction: response,AdjustAccountOutSeqEntry = <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><AdjustAccountResultMsg xmlns="http://www.huawei.com/bme/cbsinterface/cbs/accountmgrmsg">
        <ResultHeader xmlns="">
        <CommandId xmlns="http://www.huawei.com/bme/cbsinterface/common">AdjustAccount</CommandId>
        <Version xmlns="http://www.huawei.com/bme/cbsinterface/common">1</Version>
        <TransactionId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</TransactionId>
        <SequenceId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</SequenceId>
        <ResultCode xmlns="http://www.huawei.com/bme/cbsinterface/common">222222222</ResultCode>
        <ResultDesc xmlns="http://www.huawei.com/bme/cbsinterface/common">There is not enough money in the account.</ResultDesc>
      </ResultHeader>
       <AdjustAccountResult xmlns="" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />
    </AdjustAccountResultMsg></soapenv:Body>

How do I get the SequenceId, ResultCode and ResultDesc values?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Ayn
Legend

It really should be a matter of just running | xmlkv. If for some reason it's not working (I don't know why not, sorry) and you're looking for just any way to make this work, you could extract the fields and values manually with rex, like so:

| rex "<SequenceId [^>]+>(?<SequenceId>[^<]+)"

(and so on for the rest of the values as well)

0 Karma

carljohan
Path Finder

Thanks Ayn, I have looked at xmlkv but cant get it to work.
Can you give me a example of how i would use it to extract the ResultCode?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...