Splunk Search

Field Extraction on XML file, which stanza in props.conf is responsible for field extraction?

dkeck
Influencer

Hello,

I have a props.conf for a xml file. I just copied the props.conf which was automatically created in the "Add Data" process.

So I am not really familiar with the commands within the props.conf. It looks like this:

[ownsourcetype]
BREAK_ONLY_BEFORE = <Interceptor>
KV_MODE = xml
NO_BINARY_CHECK = true
TIME_FORMAT = %Y-%m-%d
TIME_PREFIX = <ActionDate>
category = Custom
disabled = false
pulldown_type = true

It's creating fields like this: Interceptor.ActionDate, Interceptor.LaunchCoords

Events look like this :

< Interceptor >
< fieldname > value< /fieldname >
< /Interceptor >

So which command in the props.conf is responsible for the field extraction? How do I change it so that the fields will look like this: ActionDate, LaunchCoords etc?

Thank you

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The line KV_MODE = xmlis doing the search time field extractions here. With XML files this is the name of fields that weill get created. Once option you can try is to setup field alias to rename Interceptor.FieldName to FieldName. See more infromation here
http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/Addaliasestofields

You need to add something like this to your props.conf

FIELDALIAS-extract = Interceptor.* AS *
0 Karma

dkeck
Influencer

Hello,

thank you. Its not quite working for me....I added the props.conf. But its not working with " FIELDALIAS-extract = Interceptor.* AS * ", its working with FIELDALIAS-extract = Interceptor.ActionDate AS ActionDate.

But thats creating a new problem, now I have both fields, ActionDate and Interceptor.ActionDate.

Is there a FIELDALIAS- that just renames the fields, instead of extracting?

Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...