How to extract xml value having multiple same child tag?

Vkeshar — Fri, 09 Sep 2022 17:05:25 GMT

I have following sample XML event where I want to extract specific value for a child tag . Ex when <Order fact> value is 'Place' then extract <Orderupdatevalue> which is false

<OrderUpdateField>
<OrderFacts>Place</OrderFacts>
<OrderDataType>String</OrderDataType>
<OrderUpdateValue>False</OrderUpdateValue>
<OrderFacts>Number</OrderFacts>
<OrderDataType>Integer</OrderDataType>
<OrderUpdateValue>1</OrderUpdateValue>
<OrderFacts>Location</OrderFacts>
<OrderDataType>String</OrderDataType>
<OrderUpdateValue>Earth</OrderUpdateValue>
</OrderUpdateField>

Re: How to extract xml value having multiple same child tag?

kamlesh_vaghela — Tue, 27 Sep 2022 05:24:19 GMT

@Vkeshar

It looks like you need the first value from multivalued data.

Can you please try this?

YOUR_SEARCH | spath | eval OrderFacts=mvindex('OrderUpdateField.OrderFacts',0), OrderUpdateValue=mvindex('OrderUpdateField.OrderUpdateValue',0) | table OrderFacts OrderUpdateValue

My Sample Search :

| makeresults | eval _raw="<OrderUpdateField> <OrderFacts>Place</OrderFacts> <OrderDataType>String</OrderDataType> <OrderUpdateValue>False</OrderUpdateValue> <OrderFacts>Number</OrderFacts> <OrderDataType>Integer</OrderDataType> <OrderUpdateValue>1</OrderUpdateValue> <OrderFacts>Location</OrderFacts> <OrderDataType>String</OrderDataType> <OrderUpdateValue>Earth</OrderUpdateValue> </OrderUpdateField>" | spath | eval OrderFacts=mvindex('OrderUpdateField.OrderFacts',0), OrderUpdateValue=mvindex('OrderUpdateField.OrderUpdateValue',0) | table OrderFacts OrderUpdateValue

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

topic Re: How to extract xml value having multiple same child tag? in Getting Data In

How to extract xml value having multiple same child tag?

Re: How to extract xml value having multiple same child tag?