https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163094#M33058 <P>Hi </P> <P>I am novice to splunk and need help in writing a splunk query in order to find Order ID (ORD********)</P> <HR /> <P>Sample XML</P> <HR /> Sat, 20 Dec 2014 12:52:14 GMT indianhans 2014-12-20T12:52:14Z https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163094#M33058 <P>Hi </P> <P>I am novice to splunk and need help in writing a splunk query in order to find Order ID (ORD********)</P> <HR /> <P>Sample XML</P> <HR /> Sat, 20 Dec 2014 12:52:14 GMT https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163094#M33058 indianhans 2014-12-20T12:52:14Z https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163095#M33059 <P>run in bar search the following search:<BR /> index=your_index_name<BR /><BR /> or<BR /> index=your_index_name source=your_source_name sourcetype=your_sourcetype_name</P> <P>index=your_index_name source=your_source_name sourcetype=your_sourcetype_name|....your_condictions_search<BR /> exple:<BR /> index=you_index host=you_host "Error" | chart count sparkline(count, 1h) as trend by host | sort -count</P> Mon, 28 Sep 2020 18:32:15 GMT https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163095#M33059 fdi01 2020-09-28T18:32:15Z https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163096#M33060 <P>I can't see your sample data.</P> Sun, 21 Dec 2014 16:59:19 GMT https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163096#M33060 martin_mueller 2014-12-21T16:59:19Z https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163097#M33061 <P>Is this even related to the question?</P> Sun, 21 Dec 2014 16:59:37 GMT https://community.splunk.com/t5/Getting-Data-In/XML-parsing-with-condition/m-p/163097#M33061 martin_mueller 2014-12-21T16:59:37Z