Dashboards & Visualizations

XML extractions not working in 6

theouhuios
Motivator

Hello

I did try XML extractions before on 4.3 which used to work fine. But in 6 I seem to have an issue.

Here is my config

BREAK_ONLY_BEFORE =^\<\?xml
SHOULD_LINEMERGE = true
MAX_TIMESTAMP_LOOKAHEAD=200
KV_MODE = xml

And the data looks like

<?xml version="1.0" encoding="UTF-8" ?>
<ResultSetData>
<Row>
<Column name="DATE_TIME">2/21/2014 9:35:53</Column>
<Column name="HOST_NAME">xxxxx</Column>
<Column name="INSTANCE_NAME">yyyyy</Column>
<Column name="USERNAME">aaaaaa</Column>
<Column name="PROFILE">zzzzz</Column>
<Column name="ACCOUNT_STATUS">ccccc</Column>
</Row>
</ResultSetData>

Line breaking and timestamp looks good but the field extractions doesn't seem to work.Any ideas?

When I use spath that works again

Tags (1)
0 Karma

theouhuios
Motivator

Any idea if this can be done?

0 Karma

aelliott
Motivator

we have it in the format etc and it works great
In addition, you probably just want to start with the tag right? so you could do break only before ^<ResultSetData etc?

0 Karma

theouhuios
Motivator

I did that too . Line Break isn't really a problem here as I am not really particular about it. Looks like I will have to change the format of the XML now. Is there no way for us to make splunk do those extractions in KV_MODE as XML?

0 Karma

theouhuios
Motivator

Is it the 2/21/2014 9:35:53 format which is creating an issue? I know that its like 2/21/2014 9:35:53 it wont have any issues. Should I change the format ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...