Reporting

Data Model - How to easily add XML elements

czzpl9
New Member

Have recently installed the new Splunk 6 and started the process of building Data models. Most of my data sources tend to be application based logs with very mixed formats and it doesn't make sense to specify the entire file as XML. As a result, when building a targeted search/dashboard I will pipe "|" my search to xmlkv to extract the input request portion.

With the new Data Model, it is easy enough to add children that narrow the search result to just the lines that contain XML data, but I'm not seeing a way to easily add all XML attributes (short of 1 by 1 single extractions)

Am I overlooking something?

Tags (2)
0 Karma
1 Solution

kpdonahoe31768
Explorer

I've been adding eval expression attributes using the spath(_raw,Parent.Child{@attribute}) method to get at all my xml attribute=value pairs.

View solution in original post

0 Karma

kpdonahoe31768
Explorer

I've been adding eval expression attributes using the spath(_raw,Parent.Child{@attribute}) method to get at all my xml attribute=value pairs.

0 Karma

splunk_worker
Path Finder

Hi

I'm also facing the same problem. Where to add spath(_raw,Parent.Child{@attribute}) in Data Modeling step?

This is my query and I want to add it to Data Model. Can you please help me with steps?

index=abc | rex "(?{[^}]+})" | mvexpand json_field | spath input=json_field

  1. created root event with index=abc
  2. added a regular express for json_field.

What is the next step for spath? If would be great if you give the steps.

Thanks in advance.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...