Dashboards & Visualizations

Collect values from semi-xml log

carljohan
Path Finder

Hi,

I have a logfile with the following syntax:

2011-10-13 09:34:29,309 [-] [HttpClientWorker-9]  INFO LogMediator To: http://www.w3.org/2005/08/addressing/anonymous,WSAction: ,SOAPAction: ,MessageID: urn:uuid:11111111111111111-222222222,Direction: response,AdjustAccountOutSeqEntry = <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><AdjustAccountResultMsg xmlns="http://www.huawei.com/bme/cbsinterface/cbs/accountmgrmsg">
        <ResultHeader xmlns="">
        <CommandId xmlns="http://www.huawei.com/bme/cbsinterface/common">AdjustAccount</CommandId>
        <Version xmlns="http://www.huawei.com/bme/cbsinterface/common">1</Version>
        <TransactionId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</TransactionId>
        <SequenceId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</SequenceId>
        <ResultCode xmlns="http://www.huawei.com/bme/cbsinterface/common">222222222</ResultCode>
        <ResultDesc xmlns="http://www.huawei.com/bme/cbsinterface/common">There is not enough money in the account.</ResultDesc>
      </ResultHeader>
       <AdjustAccountResult xmlns="" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />
    </AdjustAccountResultMsg></soapenv:Body>

How do I get the SequenceId, ResultCode and ResultDesc values?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Ayn
Legend

It really should be a matter of just running | xmlkv. If for some reason it's not working (I don't know why not, sorry) and you're looking for just any way to make this work, you could extract the fields and values manually with rex, like so:

| rex "<SequenceId [^>]+>(?<SequenceId>[^<]+)"

(and so on for the rest of the values as well)

0 Karma

carljohan
Path Finder

Thanks Ayn, I have looked at xmlkv but cant get it to work.
Can you give me a example of how i would use it to extract the ResultCode?

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...