I tried to extract xml tagNames as fields fieldNameStartTag and fieldNameEndTag using the following.
rex field=_raw "<(?
But it does not extract all tags correctly. For example I have this xml:
What I'm looking for is fieldNameStartTag and/or fieldNameEndTag to have values "ChildOne" and "ChildTwo". But the regex above gives me values like these:
1. Parent xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.abcd.com">
2. ChildOne>
Any help is appreciated.
Have you checked out the xmlkv command? This allows you to automatically extract KV pairs from XML formatted data without any regex's:
http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/xmlkv