We use Log4J log file which is fed as input to Splunk. Each entry in the XML file is XML object with timestamp.
Our requirement is to write a search the Log file and extract key fields and then use Splunk Build Report feature to Export CSV file
The challenge is to get the Child Elements of a XML Node and then concatenate them with comma delimiter.
For example here is the entry from log file
2010-11-17 12:59:24,617 [main] DEBUG splunk - marshallObjectToXml; <?xml version="1.0" encoding="UTF-8" standalone="yes"?><EventLogData xmlns="http:/xyz/EventLogData"><Data screen-name="ScottTiger"><DataNode node-type="Contract">
<Elements>
<Name name-type="Name">true</Name>
<DateOfBirth>true</DateOfBirth> <PhoneNo>true</PhoneNo
</Elements>
</DataNode></Data></EventLogData>
Wondering if Splunk provides a way how to write a search query which will result in following output
Name, DateOfBirth,PhoneNo
First you have to extract those values you're interested in. This can be done either through xpath or the rex command. Using a search like this, would bring the results in tabular form that can be exported:
sourcetype=<your sourcetype>
| rex "(?m)\<Name[^\>]*>(?<Name>[^\<]+)\</Name\>.*\<DateOfBirth[^\>]*>(?<DateOfBirth>[^\<]+)\</DateOfBirth\>.*\<PhoneNo[^\>]*>(?<PhoneNo>[^\<]+)\</PhoneNo\>"
| table Name DateOfBirth PhoneNo
Hi Ziegfried,
Thanks for your response. I tried your rex command and the search result displays the values under those tag elements whereas my requirement is to extract tag names and not the values under those tag elements.
Please note tag names are dynamic in nature i.e. one xml might have tag names : "Name DateOfBirth PhoneNo" whereas other xml might have tag names :"Gender Name PhoneNo"
Once i retrieve the list of tag names under
For example my search query should return ouput as
Name, DateOfBirth, PhoneNo