Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How can we add the first event to all existing event as a matedata?

$
0
0
Here is the case , I have an huge XML file . In which i have extracted the events based on the tags.So i have the 3 tags header, trailer and body . So, the output will be the header section as one event and body was divide into x number of events based on the internal tag and trailer has one event . I need header section to be attached on all the events . How can we do this? Structure of the xml![alt text][1] [1]: /storage/temp/254925-vikas.png

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>