All Apps and Add-ons

REST API modular input xml data parsing

leeyounsoo
Path Finder

hello splunk
i have a question that About extracting by specifying sourcetype in props.conf.
i want parsing xml data that Xml data received in response
but that data is not parsing

this is my develop environment
1. use REST API
- use REST API modular input
- Every 300 seconds https call setting
- index=main sourcetype=ex_st
- install in heavy Forwarder

  1. cluster
  2. 1 search head (heavy forwarder and indexer master in 1 search header)
  3. 2 indexer(cluster)
  4. props.conf [xmlData] category = Custom SHOULD_LINEMERGE = true KV_MODE = xml disabled = false TRUNCATE = 0 BREAK_ONLY_BEFORE = NO_BINARY_CHECK = true description = XML Data Field extract
  5. received xml data sample

alt text

0 Karma
1 Solution

leeyounsoo
Path Finder

I knew why it was not automatically parsed and I solved it.

The reason it has not been parsed is that the XML data passed to the response is so large that the event is restricted and the XML structure is corrupted.

i modified the "TRUNCATE" setting to include all the XML data in one event so that it was automatically parsed.

Here is the props.conf configuration.

[xml_data]
KV_MODE = xml
# BREAK_ONLY_BEFORE = \<data_list_wrap
BREAK_ONLY_BEFORE = \ <\? Xml version = \ "1 \ .0 \" encoding = \ "UTF-8 \" \?
SHOULD_LINEMERGE = true
TRUNCATE = 70000

View solution in original post

leeyounsoo
Path Finder

I knew why it was not automatically parsed and I solved it.

The reason it has not been parsed is that the XML data passed to the response is so large that the event is restricted and the XML structure is corrupted.

i modified the "TRUNCATE" setting to include all the XML data in one event so that it was automatically parsed.

Here is the props.conf configuration.

[xml_data]
KV_MODE = xml
# BREAK_ONLY_BEFORE = \<data_list_wrap
BREAK_ONLY_BEFORE = \ <\? Xml version = \ "1 \ .0 \" encoding = \ "UTF-8 \" \?
SHOULD_LINEMERGE = true
TRUNCATE = 70000

Damien_Dallimor
Ultra Champion

Is that XML above an example of what you want to be indexed ?

0 Karma

leeyounsoo
Path Finder

yes.
i want parsing event from that one xml data
like this :

  1. event parsing
  2. event parsing by "data" tag

----------1st evnet ----------
data
...(skip)
/data

----------2nd evnet ----------
data
...(skip)
/data

  1. field extraction
  2. fields data_tag0, data_tag1, data_tag2 ....(skip)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...