All,
I have a log file which is largely key value, with some random human readable language tossed in. Recent upgrades have resulted in XML getting mixed into the party.
Does Splunk have a mode to which might be able to address the mixture of data types in the same logs?
%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12 </value>
<nameofprod>Name </nameofprod>
dump is status="complete"
Question for you pertaining to your example data - would it be multiple 'events' in a similar fashion as:
%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12 </value>
<nameofprod>Name </nameofprod>
dump is status="complete"
%time% app=SOMETHING something=value message="Some human readable thing"
<value> 12 </value>
<nameofprod>Name </nameofprod>
dump is status="complete"
....
If so, you could (after the data is already in the index) use transaction to encapsulate an entire 'stanza' as one event, then use other search commands to include/exclude what you want.
How complex your xml portion can get?? Is it always just single level values??
It's pretty standard. I've been temped to just SEDCMD away the opening tag with a key=" instead then completely remove the closing tag to just a closing ". But this seems like a lot of manual work. Would be nice is there was a "mixed type" auto extraction option? But if not, maybe the SED option?