You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
35 lines
875 B
35 lines
875 B
8 months ago
|
# Version 4.0
|
||
|
|
import sys,splunk.Intersplunk
|
||
|
|
import re
|
||
|
|
import urllib
|
||
|
|
import xml.sax.saxutils as sax
|
||
|
|
|
||
|
|
XML_KV_RE = re.compile(r"<(.*?)(?:\s[^>]*)?>([^<]*)</\1>")
|
||
|
|
|
||
|
|
field = "_raw"
|
||
|
|
|
||
|
|
if len(sys.argv)>1:
|
||
|
|
field = sys.argv[1]
|
||
|
|
|
||
|
|
try:
|
||
|
|
results,dummyresults,settings = splunk.Intersplunk.getOrganizedResults()
|
||
|
|
|
||
|
|
for r in results:
|
||
|
|
if field in r:
|
||
|
|
raw = r[field]
|
||
|
|
rawOut = sax.unescape( raw )
|
||
|
|
while( rawOut != raw ):
|
||
|
|
raw = rawOut
|
||
|
|
rawOut = sax.unescape( raw )
|
||
|
|
r[field] = rawOut
|
||
|
|
|
||
|
|
for kvpair in XML_KV_RE.findall(rawOut):
|
||
|
|
r[kvpair[0]] = kvpair[1]
|
||
|
|
|
||
|
|
except:
|
||
|
|
import traceback
|
||
|
|
stack = traceback.format_exc()
|
||
|
|
results = splunk.Intersplunk.generateErrorResults("Error : Traceback: " + str(stack))
|
||
|
|
|
||
|
|
splunk.Intersplunk.outputResults( results )
|