I have the following XML format file. I triesd to Parse in Splunk to Reach the Below table format. but i faced an issue to make the Zone repetitive in every line.
<PolicyGlobal>
<Zone>ABC</Zone>
<policy>
<PolicyName>A<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
<policy>
<PolicyName>B<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
</PolicyGlobal>
<PolicyGlobal>
<Zone>DEF</Zone>
<policy>
<PolicyName>C<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
<policy>
<PolicyName>D<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
</PolicyGlobal>>
PolicyName,Attribute1,Attribute2,Zone
A,Value,Value,ABC
B,Value,Value,ABC
C,Value,Value,DEF
D,Value,Value,DEF
I tried to cut the values with LINE_BREAKER : with "PolicyGlobal" it gets all the all the policies in 1 line. and if i changed the LINE_BREAKER value with Policy it doesn't get the Zone
Can you help?
can you post the current props.conf please ?
| makeresults
| eval _raw="<PolicyGlobal>
<Zone>ABC</Zone>
<policy>
<PolicyName>A<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
<policy>
<PolicyName>B<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
</PolicyGlobal>
<PolicyGlobal>
<Zone>DEF</Zone>
<policy>
<PolicyName>C<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
<policy>
<PolicyName>D<PolicyName>
<Attribute1>Value</Attribute1>
<Attribute2>Value</Attribute2>
</policy>
</PolicyGlobal>"
| makemv delim="
" _raw
| stats delim="," list(_raw) as raw
| nomv raw
| eval raw=replace(raw,"</PolicyGlobal>,<PolicyGlobal>","</PolicyGlobal>#<PolicyGlobal>")
| makemv delim="#" raw
| stats count by raw
| rex field=raw mode=sed "s/<[\w\/]+>//g"
| eval raw=trim(raw,",")
| rex field=raw mode=sed "s/,+/,/g"
| eval Zone=mvindex(split(raw,","),0), text1=mvindex(split(raw,","),1)." ".mvindex(split(raw,","),2)." ".mvindex(split(raw,","),3)
, text2=mvindex(split(raw,","),4)." ".mvindex(split(raw,","),5)." ".mvindex(split(raw,","),6)
| eval tmp=mvappend(text1,text2)
| mvexpand tmp
| table Zone tmp
| eval PolicyName=mvindex(split(tmp," "),0), Attribute1=mvindex(split(tmp," "),1), Attribute2=mvindex(split(tmp," "),2)
| table Zone PolicyName Attribute*
It ’s too hard to be helpful.