How can we convert raw event to XML format in Splunk?

[nerelluk]

I want to convert a raw event into an XML viewer format in Splunk. The event is of 30-40 lines.

Sample Event:

[woodcock]

You have 2 main tools, but keep in mind that you may have to shape your _raw field before either of them will work:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath

[jkat54]

Try using xmlkv, xpath, rex, and/or extract search commands. See if that's what you want.

Also make sure your view is set correctly.

There's table, list, and raw views (selectable with a drop down at the top of the list of events). Raw view will not render the syntax highlighting.

Also fast mode will not auto-extract fields unless they are indexed fields.

[niketn]

@nerelluk your requirement is to parse and extract XML data or to show the same as more readable xml format (visualization)?

[nerelluk]

yes ..could you please help me in this

[VatsalJagani]

Hi @nerelluk,

In splunk dashboard you can use HTML and JS - Ref. Add HTML and JS file and use that JS file to display XML content on to the dashboard. For search result you can handle search result from JS. You can use good libraries to display XML nicely.

Hope this helps!!!

[nerelluk]

Thanks for the info VatsalJagani

it would be helpful for me if you can brief me...

I am not familiar with JS...

Regards,
Nerellu

[VatsalJagani]

@nerelluk - If you are not much familiar with JS it might take long time to create the feature that you asked for as it is not very straight forward requirement. But some references you can refer for quick start.

How to run search from JS?
And for xml viewer I've already mentioned Js library in the answer.

[nerelluk]

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxdsdsassasacdasdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx