Splunk Search

How to configure Splunk to extract fields from XML tags?

rtestu_splunk
Splunk Employee
Splunk Employee

Hi!

I know there are many topics on XML field extractions, but did not see one that matches my requirement!

I receive XML events from a JMS queue (Active MQ) and the raw event in Splunk looks like that :

Thu Feb 25 19:20:14 CET 2016 name=QUEUE_msg_received event_id=ID:rtestu-mbair15-56318-1456424165985-1:6:1:1:1 msg_dest=queue.name msg_body=<typ:Reservation xmlns:typ="http://services.talend.org/reservation/types">
        <reservationId>376121286</reservationId>
        <customer>
            <city>Vegas</city>
            <email>…..

So, there are several key / value pairs that match the different JMS metadata (queue name, etc.) and the last one (msg_body) is the business payload, in XML.

I would like Splunk to automatically extract the XML tags as fields. Is it possible ?

I can't use kv_mode=xml since the event is only partially in XML.
Is there a way to specify that a field is an XML field so that Splunk could parse it and extract the tags?

By the way, I managed to do it via a search, but would like to be able to do it via configuration to simplify all the searches.

Thanks !
Romain.

0 Karma
1 Solution

rtestu_splunk
Splunk Employee
Splunk Employee

That's exactly what I needed. Just tried and it works.
Apparently, I did not search enough ... 😞

Thanks a lot !
Romain.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...