topic Re: How to group XML request events in Splunk Dev

How to group XML request events

Thulasinathan_M — Tue, 15 Aug 2023 09:19:02 GMT

Hi Splunk Experts,

I've different XML request(100+ requests) as a multi-line event. Is it possible to stat these requests and get their count. But all these request would have any values between their tags and rex-ing all these request to stat them would be a difficult task, but is there any possible way to achieve this criteria. Any suggestion would be very much helpful!!. Thanks in advance!!

Re: How to group XML request events

ITWhisperer — Tue, 15 Aug 2023 09:36:29 GMT

You can use spath to extract fields from XML (as well as JSON).

Perhaps if you could share some anonymised events, we might be able to advise you better.

Re: How to group XML request events

Thulasinathan_M — Tue, 15 Aug 2023 09:48:47 GMT

Hi @ITWhisperer!! Thanks for the assistance.
The Request 1 & Request 3 shares the same template, but the value passed in the tags are different, but I want to consider these two request as same, while using a stat command and expecting it to return count as '2' for request with books & genres as '1'

Request 1:

<?xml version="1.0"?> <catalog> <book id="bk101"> <author>Gambardella, Matthew</author> <title>XML Developer's Guide</title> <genre>Computer</genre> <price>44.95</price> <publish_date>2000-10-01</publish_date> <description>An in-depth look at creating applications with XML.</description> </book> </catalog>

Request 2:

<?xml version="1.0"?> <catalog> <genres code="gc101"> <genre>Romance</genre> <genre>Horror</genre> <genre>Science Fiction</genre> </genres> </catalog>

Request 3:

<?xml version="1.0"?> <catalog> <book id="bk111"> <author>O'Brien, Tim</author> <title>MSXML3: A Comprehensive Guide</title> <genre>Computer</genre> <price>36.95</price> <publish_date>2000-12-01</publish_date> <description>The Microsoft MSXML3 parser is covered in detail, with attention to XML DOM interfaces, XSLT processing, SAX and more.</description> </book> </catalog>

Re: How to group XML request events

ITWhisperer — Tue, 15 Aug 2023 10:02:20 GMT

If you just want to count the first level keys within catalog, you could do this

| rex "<catalog>\s+<(?<key>\w+)" | stats count by key

Re: How to group XML request events

Thulasinathan_M — Tue, 15 Aug 2023 10:28:29 GMT

There are no such differentiates, just to make clear on requirement I shared the sample xml request. The only difference we can identify is based on complete template.

Re: How to group XML request events

ITWhisperer — Tue, 15 Aug 2023 10:44:48 GMT

I am not sure I understand what you mean - here is a runanywhere example showing the extraction of the first level key from catalog and the stats count

| makeresults | eval _raw="<?xml version=\"1.0\"?> <catalog> <book id=\"bk101\"> <author>Gambardella, Matthew</author> <title>XML Developer's Guide</title> <genre>Computer</genre> <price>44.95</price> <publish_date>2000-10-01</publish_date> <description>An in-depth look at creating applications with XML.</description> </book> </catalog>|<?xml version=\"1.0\"?> <catalog> <genres code=\"gc101\"> <genre>Romance</genre> <genre>Horror</genre> <genre>Science Fiction</genre> </genres> </catalog>|<?xml version=\"1.0\"?> <catalog> <book id=\"bk111\"> <author>O'Brien, Tim</author> <title>MSXML3: A Comprehensive Guide</title> <genre>Computer</genre> <price>36.95</price> <publish_date>2000-12-01</publish_date> <description>The Microsoft MSXML3 parser is covered in detail, with attention to XML DOM interfaces, XSLT processing, SAX and more.</description> </book> </catalog>" | eval xml=split(_raw,"|") | mvexpand xml | table xml | rex field=xml "<catalog>\s+<(?<key>\w+)" | stats count by key