In this example, we will use Python's minidom module to parse and pretty print XML if possible. The template will look for a field called xml or fall back on _raw.
Let's look through the files included in ImplementingSplunkExtendingExamples. The template file located in appserver/event_renderers/xml.html contains the following lines of code:
<%inherit file="//results/EventsViewer_default_renderer.html" /> <%def name="event_raw(job, event, request, options, xslt)"> <% from xml.dom import minidom import sys def escape(i): return i.replace("<", "<").replace(">", ">") _xml = str( event.fields.get('xml', event.fields['_raw']) ) try: pretty = minidom.parseString(_xml).toprettyxml(indent=' '*4) pretty = escape( pretty ) ...
