Hi Splunkers,
I have a question regarding the input extracion of XML-Fields (with inputs and transforms).
I have tried to follow the advices in this post: https://answers.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how.html (not sure if the link shows up...) but have not been successful yet, since the XML-structure of my data is somehow different.
Here's the data:
Yes, it's pretty unstructured, and it's not clean XML...
I have tried to put `KV-MODE = xml` in my inputs.conf, with no effect. Also, the other suggested setting, like `BREAK_ONLY_BEFORE` or `LINE_BREAKER` did not split my events.
I understand, that there should be the possibility to extract the KV-pairs inside the <Client> Tags somehow, maybe with an additional transform command. I fugured it sould be `REGEX = (\w+)="([^"]+)"` and `FORMAT = $1::$2` inside transforms.conf - but I am missing the connection.
Can somebody please enlight me?
↧