Dashboards & Visualizations

How do I extract field values from XML logs?

aruotolo
New Member

Hi,

I have log files containing text and XML. I need to extract all fields from the XML rows.

alt text

I tried using

Props.conf:

TRUNCATE = 0
NO_BINARY_CHECK = 1
pulldown_type = 1
KV_MODE = xml
TRANSFORMS = itepm339-xml

And transforms.conf

REGEX = \<(\w+[^\n\/\>]+)\/?\>([^\<\n][^\<]*)\<
FORMAT = $1::$2

It works, but extracts only the first couple field-value from XML:

alt text

Please can you help me to understand what i am missing?

Tags (2)
0 Karma

nswondem
Path Finder

Hello aruotolo,

Please refer to a previously answered question at https://answers.splunk.com/answers/587570/index-time-field-extraction-for-xml-data-1.html

Thanks
nswondem

0 Karma

aruotolo
New Member

Hi @Nswondem

but the page of your link doesn't exist error 404.

Alfredo

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @nswondem,

there was just a typo in that link. I've removed it, and now you should be able to click it. Hopefully it helps you with your query! Let us know.

Thanks for posting!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...