Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Parse pesudo-XML data during input

$
0
0
Hi Splunkers, I have a question regarding the input extracion of XML-Fields (with inputs and transforms). I have tried to follow the advices in this post: https://answers.splunk.com/answers/683/xml-input-line-breaking-and-field-extraction-how.html (not sure if the link shows up...) but have not been successful yet, since the XML-structure of my data is somehow different. Here's the data: Yes, it's pretty unstructured, and it's not clean XML... I have tried to put `KV-MODE = xml` in my inputs.conf, with no effect. Also, the other suggested setting, like `BREAK_ONLY_BEFORE` or `LINE_BREAKER` did not split my events. I understand, that there should be the possibility to extract the KV-pairs inside the <Client> Tags somehow, maybe with an additional transform command. I fugured it sould be `REGEX = (\w+)="([^"]+)"` and `FORMAT = $1::$2` inside transforms.conf - but I am missing the connection. Can somebody please enlight me?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>