Splunk Search

xml convert csv

klychnikov
Explorer

I have a xml file which I want to convert to a csv, but do not work regular expressions.

> inputs.conf
> [monitor:\\SPLUNK0\C$\test\1]
> index = kasper
> _whitelist = .*\.xml
> 
> props.conf  [source::...kasper*.xml]
> TRUNCATE =  0 
> SEDCMD-1 = s/(?m)(^.*?</Worksheet>)//g ###clean the garbage
> SEDCMD-2 = s/(?m)(<W\w*\s\w*\SN\w*[="]+M\w*.*>$)//g ####clean the garbage
> SEDCMD-3 = s/(?m)(</R\w*>)/\n/g ###transfer the event to a new line
> SEDCMD-4 = s/(?m)(</D\w*>)/;/g ### set separators
> SEDCMD-5 = s/(?m)(<[^>]*>)//g ### delete tags
> sourcetype = csv_kasper  
> transforms.conf
> [csv_kasper]
> DELIMS=";"
> FIELDS="Status","V-host","Group","Computer","LastData","description","IP","Alive","Domain","NetBIOS","DomainName","DNS"

splunkd.log
12-06-2012 18:55:47.043 +0300 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-1", string="s/(?m)(^.*?</Worksheet>)//g", errMsg="Failed to initialize sed. Invalid option string: /g"
12-06-2012 18:55:47.043 +0300 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-3", string="s/(?m)(</R\w*>)/\n/g", errMsg="Failed to initialize sed. Invalid option string: \n/g"
12-06-2012 18:55:47.043 +0300 ERROR regexExtractionProcessor - Error while parsing sed name="SEDCMD-4", string="s/(?m)(</D\w*>)/;/g", errMsg="Failed to initialize sed. Invalid option string: ;/g
Tags (1)
0 Karma

klychnikov
Explorer
Статус;Виртуальный Сервер;Группа;Клиентский компьютер;Последнее соединение с Сервером администрирования;Причина добавления в отчет;IP-адрес;Видим в сети;Домен;NetBIOS-имя;Доменное имя;DNS-домен;
Критический;;0_test;BD00;7 ноября 2012 г. 15:17:23;Не установлен Антивирус Касперского. ;10.54.44.68;7 ноября 2012 г. 15:17:23;dom;BD00;bd00;dom;
Критический;;0_test;BD00;16 ноября 2012 г. 12:01:16;Давно не выполнялся поиск вирусов. ;10.54.45.26;16 ноября 2012 г. 12:01:16;dom;BD00;bd00;dom;
Критический;;0_test;BEOVA;16 ноября 2012 г. 11:58:35;Давно не выполнялся поиск вирусов. ;10.54.44.70;16 ноября 2012 г. 12:06:28;dom;BEZULOVA;beova;dom;
Критический;;0_test;BRCH11;16 ноября 2012 г. 11:55:25;Давно не выполнялся поиск вирусов. ;10.54.42.71;16 ноября 2012 г. 11:55:25;dom;BRONICH11;brich11;dom;
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Looking at the splunkd logs, you have to escape slashes in your SED regex. Try these:

SEDCMD-1 = s/(?m)(^.*?<\/Worksheet>)//g ###clean the garbage
SEDCMD-3 = s/(?m)(<\/R\w*>)/\n/g ###transfer the event to a new line
SEDCMD-4 = s/(?m)(<\/D\w*>)/;/g ### set separators

0 Karma

klychnikov
Explorer

Thank you regex works.

Now is not working transforms.
Get 1 event without breaking

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...