Dashboards & Visualizations

Collect values from semi-xml log

carljohan
Path Finder

Hi,

I have a logfile with the following syntax:

2011-10-13 09:34:29,309 [-] [HttpClientWorker-9]  INFO LogMediator To: http://www.w3.org/2005/08/addressing/anonymous,WSAction: ,SOAPAction: ,MessageID: urn:uuid:11111111111111111-222222222,Direction: response,AdjustAccountOutSeqEntry = <soapenv:Body xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><AdjustAccountResultMsg xmlns="http://www.huawei.com/bme/cbsinterface/cbs/accountmgrmsg">
        <ResultHeader xmlns="">
        <CommandId xmlns="http://www.huawei.com/bme/cbsinterface/common">AdjustAccount</CommandId>
        <Version xmlns="http://www.huawei.com/bme/cbsinterface/common">1</Version>
        <TransactionId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</TransactionId>
        <SequenceId xmlns="http://www.huawei.com/bme/cbsinterface/common">1111111111</SequenceId>
        <ResultCode xmlns="http://www.huawei.com/bme/cbsinterface/common">222222222</ResultCode>
        <ResultDesc xmlns="http://www.huawei.com/bme/cbsinterface/common">There is not enough money in the account.</ResultDesc>
      </ResultHeader>
       <AdjustAccountResult xmlns="" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />
    </AdjustAccountResultMsg></soapenv:Body>

How do I get the SequenceId, ResultCode and ResultDesc values?

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Ayn
Legend

It really should be a matter of just running | xmlkv. If for some reason it's not working (I don't know why not, sorry) and you're looking for just any way to make this work, you could extract the fields and values manually with rex, like so:

| rex "<SequenceId [^>]+>(?<SequenceId>[^<]+)"

(and so on for the rest of the values as well)

0 Karma

carljohan
Path Finder

Thanks Ayn, I have looked at xmlkv but cant get it to work.
Can you give me a example of how i would use it to extract the ResultCode?

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...