Splunk Search

How to edit my transforms.conf xml field extraction?

packet_hunter
Contributor

Hi,
I am not finding any previous posts that answer my question so here it is.

I have a security appliance that sends XML alerts to Splunk.

in my props.conf file I have

[sec_app_xml]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)(^\<\?xml.*\<\/alerts\>$)

now I would like extract all values from between the tags for example

<smtp-header>  blah blah blah ... etc ...</smtp-header>

so that I get the field smtp_header and the value contained between the xml tags.

I started a Transforms.conf

#XML field extractions
[sec_app_xml]

but I have had no luck with a regex?

Please advise, Thank you.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

I believe you need to setup KV_MODe=xml for your sourcetype in your search head (for search time field extractions).

props.conf

[yoursourcetype]
KV_MODE= xml

See this: http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Automatickey-valuefieldextractionsatsear...

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I believe you need to setup KV_MODe=xml for your sourcetype in your search head (for search time field extractions).

props.conf

[yoursourcetype]
KV_MODE= xml

See this: http://docs.splunk.com/Documentation/Splunk/6.5.2/Knowledge/Automatickey-valuefieldextractionsatsear...

0 Karma

packet_hunter
Contributor

It works Thank you

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...