Splunk Enterprise

Extract xml section in props.conf

Hazel
Communicator

Hello

I am trying to extract specific sections from my xml file in props.conf into events. The events should look like the following and appear multiple times inside my xml

 <jms-system-resource>
    <name>Routere</name>
    <target>trade</target>
    <sub-deployment>
      <name>DeployToRouter</name>
      <target>RouterS</target>
    </sub-deployment>
    <descriptor-file-name>jms/router.xml</descriptor-file-name>
  </jms-system-resource>

Is there a way to extract these out using props.conf? I can get it to break when it finds <jms-system-resouce>, which successfully creates events that start with <jms-system-resouce, but then i want to split off the event again at <jms-system-resource>. Is there any way to do this? I've tried a couple of things but can't get it to work.

I basically think I want a combination of BREAK_ONLY_BEFORE and BREAK_ONLY_AFTER , but it doesn't work. Or, is there a way to use or inside a BREAK_ONLY_BEFORE, i tried this too

BREAK_ONLY_BEFORE = (<jms-system-resource>|<jds-datasource)

Which is one of the options that usually follows the jms-system resource, but this didn't work either.

Any ideas?

Hazel

0 Karma

lguinn2
Legend

The < (less-than sign) is a special character in regular expressions, and must be escaped. Also, I have found that it works best to specify "non-capturing" parentheses. So I would use this regular expression, and I think it would do what you want.

BREAK_ONLY_BEFORE = (?:\<jms-system-resource>|\<jds-datasource)
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...