I have thousands of XML files which are being indexed in Splunk and I would like to extract values from the XML. The XML data contains product information and transactions every time a sale occurs. However, when I used xmlkv to extract the values from the XML, if there are multiple transactions, Splunk only sees the last key-value pair and disregards that multiple items were in the bucket/shopping cart. I've played with xmlsplit and reviewed the documents regarding splitting the XML file in the props.conf, however then each event would lose valuable information like the timestamp and location which isn't stored in each transactionline. An example of the data is below:
<JournalHeader>
</JournalHeader>
<SaleEvent>
<TransactionDetailGroup>
<TransactionLine status="normal">
<ItemLine>
<ItemCode>
<POSCode>1001</POSCode>
</ItemCode>
<Description>Product A</Description>
</ItemLine>
</TransactionLine>
<TransactionLine status="normal">
<ItemLine>
<ItemCode>
<POSCode>1011</POSCode>
</ItemCode>
<Description>Product B</Description>
</ItemLine>
</TransactionLine>
<TransactionLine status="normal">
<ItemLine>
<ItemCode>
<POSCode>1021</POSCode>
</ItemCode>
<Description>Product C</Description>
</ItemLine>
</TransactionLine>
<TransactionLine status="normal">
...
</TransactionLine>
</TransactionDetailGroup>
<TransactionSummary>
...
</TransactionSummary>
</SaleEvent>
If I do a table of 100 events and list the POSCode and Description, I would get 100 events with either 1001 & Product A or 1021 & Product C.
Is there a way to keep the event as a single event but drill down into each TransactionLine and pull the key-values from each?
... View more