Splunk Search

How to extract XML out of a native log structure?

lkanzlie_2
Engager

Hi,

I'm looking for a solution to extract xml out of standard logs on order to perform some xpath.
I cannot use rex as I do need to extract values having same tag names in different subtrees.

index="index" sourcetype="sourcetype" xml_2=* | xpath field=test1 "//Metadata/" | table test1 

is showing no result.

How to make Splunk extract xml out of native log structure?

niketn
Legend

You should use field and outfield for xpath as given below.

<Your Base Search>
| xpath field=xml_2 outfield=test1 "//Metadata"
| table test1, xml2

Alternatively you can also try the spath command

<Your Base Search>
| spath input=xml_2 path="Metadata" output=test1
| table test1

For reference
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

For xpath to work, the field test1 should have the xml portion, does it? Also, would be much simpler to provide suggestions if you could share some sample events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...