Experts,
Here is my Log content and I wish to extract fields like
<tns:SplunkLogs xmlns:tns=\http://www.example.org/SplunkLogs\>\n
<tns:ServiceName>mmf-bwce-customerOrder.application</tns:ServiceName>\n
<tns:TransactionId>123</tns:TransactionId>\n
<tns:EventType>Hold</tns:EventType>\n
<tns:TimeStamp>2017-06-05T04:04:06.051Z</tns:TimeStamp>\n
<tns:Payload>123456</tns:Payload>\n
<tns:ProcessName>Delivery</tns:ProcessName>\n
<tns:Activity>Request</tns:Activity>\n
</tns:SplunkLogs>\n
All I need is to extract the fields like ServiceName, TransactionId and so on. I have done this thru props.conf and transforms.conf as below and it works perfectly fine. But I wish to move it as a search time extraction (Without a transforms.conf). Any input is appreciated.
my_stanza]
REPORT-xmlkv = xmlkv-alternative
Transforms.conf:
[xmlkv-alternative]
FORMAT = $2::$3
REGEX = <([^\s\>]*):([^\s\>]*)\>([^<]*)\<\/\1:\2\>
Did you try this solution?
https://answers.splunk.com/answers/133533/xml-extraction.html?utm_source=typeahead&utm_medium=newque...
have a look at spath
command:
The spath
command enables you to extract information from structured data formats like XML
http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/spath
Thanks for the response. I was not able to extract the fields with spath as my field values are at the same level. Fortunately, I got a lead to use xmlkv from the documentation link with which I was able to get the desired field extracted. Thanks for your help