Getting Data In

How to extract XML fields combining event?

tp92222
Explorer
<?xml version="1.0"?>

-<Customers to="1234" from="1240" time_t="1464236385853">


-<Customer id="1234">

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

<Priority value="1">Medium</Priority>

<Type>Buesiness</Type>

<ID>007-123</ID>

<Title>More store</Title>


-<Contacts>

<Contact>Reference1</Contact>

<Contact>Reference2</Contact>

<Contact>Reference</Contact>

<Contact>Reference</Contact>

</Contacts>

<Summary>Summary of Customer</Summary>

<Analysis>purchase anaysis </Analysis>


<Rating>

<customer rating>3</customer rating>

<Rating>
</Customer>
<Customer id="1235">

similer as above

</Customer>
</Customers>

i modified props.config as following

[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1

probleam is splunk creat 3 events for each customer inforamtion

event one

event two

2013-02-09 20:40:10

event 3
2016-03-23 18:20:06

Medium

Buesiness

007-123

-

Reference1

Reference2

Reference

Reference

Summary of Customer

purchase anaysis

3

i want one customers info in single event

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Can you try this:

[XML]
 DATETIME_CONFIG = CURRENT
 KV_MODE = xml
 LINE_BREAKER = (\<Customers)
 MUST_BREAK_AFTER = \<\/Customers\>
 NO_BINARY_CHECK = 1
 SHOULD_LINEMERGE = false
 TRUNCATE = 0
 pulldown_type = 1

your line breaker has an extra ">" that is not in you data

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

tp92222
Explorer

UPDATED
<?xml version="1.0"?>

-<Customers to="1234" from="1240" time_t="1464236385853">


-<Customer id="1234">

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

<Priority value="1">Medium</Priority>

<Type>Buesiness</Type>

<ID>007-123</ID>

<Title>More store</Title>


-<Contacts>

<Contact>Reference1</Contact>

<Contact>Reference2</Contact>

<Contact>Reference</Contact>

<Contact>Reference</Contact>

</Contacts>

<Summary>Summary of Customer</Summary>

<Analysis>purchase anaysis </Analysis>


<Rating>

<customer rating>3</customer rating>

<Rating>
</Customer>
<Customer id="1235">

similer as above

</Customer>
</Customers>

i modified props.config as following

[XML]
DATETIME_CONFIG = CURRENT
KV_MODE = xml
LINE_BREAKER = (<Customers>)
MUST_BREAK_AFTER = \</Customers\>
NO_BINARY_CHECK = 1
SHOULD_LINEMERGE = false
TRUNCATE = 0
pulldown_type = 1

probleam is splunk creat 3 events for each customer inforamtion

event one

   -<Customers to="1234" from="1240" time_t="1464236385853">


    -<Customer id="1234">

event two

<Created time_t="1455050410000">2013-02-09 20:40:10</Created>

event 3

<Updated time_t="1458757206000">2016-03-23 18:20:06</Updated>

    <Priority value="1">Medium</Priority>

    <Type>Buesiness</Type>

    <ID>007-123</ID>

    <Title>More store</Title>


    -<Contacts>

    <Contact>Reference1</Contact>

    <Contact>Reference2</Contact>

    <Contact>Reference</Contact>

    <Contact>Reference</Contact>

    </Contacts>

    <Summary>Summary of Customer</Summary>

    <Analysis>purchase anaysis </Analysis>


    <Rating>

    <customer rating>3</customer rating>

    <Rating>
    </Customer>
    <Customer id="1235">

    similer as above

    </Customer>
    </Customers>

i want one customers info in single event

0 Karma

jkat54
SplunkTrust
SplunkTrust

FWIW you cant use LINE_BREAKER and MUST_BREAK_AFTER. You'll want to carefully re-read that section of props.conf.spec

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...