Splunk Search

XML: Extract field and assign to multiple events

a1352019
Engager

I'm attempting to read in an XML file in the following format:

<a> data </a>
<q> other data </q>
   <b> item </b>
      <i> item data </i>
      <p> more item data </p>
   <b> another item </b>
      <i> item data </i>
      <p> more item data </p>
   <b> yet another item </b>
      <i> item data </i>
      <p> more item data </p>

I've managed to modify the props.conf to split the xml and read in each 'b' item (and it's children) as a separate event.

What I'm stuck on is extracting the data held within the 'a' and 'q' tags and assigning that to every event that is received below it.

Is this possible?

gelica
Communicator

Did you solve this? 🙂

0 Karma

Ayn
Legend
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...