Getting Data In

XML fields and multivalues

tjohnston2
Splunk Employee
Splunk Employee

I am trying to search on the name field by scap-id in the following data. When I search against it Splunk returns one value for the name and throws out the rest. How do I make name a multivalued field. I have included a dataset and my props.conf and transforms.conf.

<controls scap-id='CVE-2010-1241'>
    <control internal-id='8081023'>
      <name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='8081024'>
      <name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='8091029'>
      <name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>3</passed>
        <failed>1</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='8091030'>
      <name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9081021'>
      <name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9081022'>
      <name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9091019'>
      <name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9091020'>
      <name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
  </controls>

props.conf

[bigfix]
#TIME_PREFIX = <Extended_Timestamp>
#MAX_TIMESTAMP_LOOKAHEAD = 200
#MUST_BREAK_AFTER = </controls>
#BREAK_ONLY_BEFORE_DATE = false
#SHOULD_LINEMERGE = true
#LINE_BREAKER = \>\s*(?=\<control\>)
BREAK_ONLY_BEFORE = <controls\sscap-id
REPORT-bigfix = xml-bigfix

transforms.conf

[xml-bigfix]
MV_ADD = true
Tags (1)
0 Karma

mjyates
New Member

Can you verify this works?? My transforms.conf looks like this

[xmlkv_multivalue] REGEX = <(.?)(?:\s[^>])?>([^<]*) FORMAT = $1::$2 MV_ADD = true

[xml_bigfix] REGEX = /])?/>([^\<])\<\/name

and when I search I pipe to either on the search line and get only one value per xml pair not multiples as advertised...

0 Karma

tjohnston2
Splunk Employee
Splunk Employee

Thanks I would now like a tabular report which looks like this

scap_id
name
name
name
etc...

I can't seem to figure it out. I have tried stats list(name) by scap_id, stats values(name) by scap_id. Help

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
[xml-bigfix]
REGEX = /<name(?:\s[^\>]*)?/>([^\<]*)\<\/name
0 Karma

Paolo_Prigione
Builder

If you don't mind having many lines for each sscap-id: first expand the multivalued field to multiple events, then use table: "... | mvexpand name | table _time scap-id name"

0 Karma

sideview
SplunkTrust
SplunkTrust

Sounds like you want "chart count over scap_id by name"

0 Karma

tjohnston2
Splunk Employee
Splunk Employee

Thanks I would now like a tabular report which looks like this scap_id name name name etc... I can't seem to figure it out. I have tried stats list(name) by scap_id, stats values(name) by scap_id. Help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...