topic Re: How to extract all children in xml? in Getting Data In

How to extract all children in xml?

matstap — Thu, 18 Jan 2018 18:54:57 GMT

I have part of an xml file which looks like this:

<Field name="Name1" type="string" length="16">
    <Comments>
        <p/>Value 1
    </Comments>
</Field>
<Field name="Name2" type="string" length="8">
    <Comments>
        <p/>Value 2:
        <ul>
           <li>Value 2a</li>
           <li>Value 2b</li>
        </ul>
    </Comments>

I am trying to make a field called Comments with all the text inside the Comments tag for each Field tag.
Example:
For Name1, Comments="Value 1"
For Name2, Comments="Value 2: Value 2a Value2b

In the case of Name2, how do I capture the list as well as the paragraph?

I have tried spath path=...Field.Comments but that only captures the <p> .

Re: How to extract all children in xml?

cmerriman — Fri, 19 Jan 2018 14:39:54 GMT

have you tried xpath instead?

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Xpath

it still might be tricky to get all of them under comments, but what if you just tried |xpath outfield=Comments "//Field/Comments"

Re: How to extract all children in xml?

matstap — Fri, 19 Jan 2018 18:40:27 GMT

Thanks. That worked to capture everything inside the Comments. I then removed the tags to get my desired result: | rex field=Comments mode=sed "s/\<((\w|\/)+)\>//g"