topic How to Fetch key/value pair from webservice request? in Getting Data In

How to Fetch key/value pair from webservice request?

sachinlohchab — Thu, 15 Feb 2018 18:28:47 GMT

Hi I need to fetch key/value pair values from below request.. please help

like for Name key should return Siri
for USER_ROLE return BUS

Request passing as below:

        <entry>
            <key>Name</key>
            <value>Siri</value>
        </entry>
        <entry>
            <key>U_ROLE</key>
            <value>BUS</value>
        </entry>

Re: How to Fetch key/value pair from webservice request?

richgalloway — Thu, 15 Feb 2018 22:31:03 GMT

Have you looked at the xpath command?

Re: How to Fetch key/value pair from webservice request?

sachinlohchab — Fri, 16 Feb 2018 22:39:25 GMT

Can you give me the command to fetch per my request. I am new to splunk

Re: How to Fetch key/value pair from webservice request?

micahkemp — Sat, 17 Feb 2018 03:04:43 GMT

I'm not proud of this search, but it does work:

| makeresults 
| eval _raw="<entry><key>Name</key><value>Siri</value></entry><entry><key>U_ROLE</key><value>BUS</value></entry>"
| xpath outfield=value "//entry/value"
| eval value=mvjoin(value, ",")
| xpath outfield=key "//entry[value]/key"
| makemv delim="," value
| eval key_value=mvzip(key, value)
| fields key_value
| mvexpand key_value
| rex field=key_value "(?<key>[^,]+),(?<value>.*)"

The mvjoin and makemv lines are there because, for some reason, calling xpath a second time results in the first multivalue field it produced being squashed into a single, space-delimited value instead.

Perhaps someone will come along and show the proper way to do this. I've never used it before.

Re: How to Fetch key/value pair from webservice request?

sachinlohchab — Tue, 29 Sep 2020 18:04:55 GMT

Written below regex to fetch the value I need...works for me..

rex field=_raw "USR_ROLE<\/key>$\n[ ](?.|)<\/value>$"

Re: How to Fetch key/value pair from webservice request?

niketn — Sun, 18 Feb 2018 04:10:07 GMT

@sachinlohchab, based on the sample data provided, try the following run anywhere search. If you have JSON data, KV_MODE=json should be set in props.conf for your sourcetype for automatic search time field extraction. In anycase you can use the commands from | spath onward for your current base search.

| makeresults
| eval _raw="<entry><key>Name</key><value>Siri</value></entry><entry><key>U_ROLE</key><value>BUS</value></entry>"
| spath
| eval data=mvzip('entry.key','entry.value')
| fields - entry.*
| mvexpand data
| eval data=split(data,",")
| eval key=mvindex(data,0), value=mvindex(data,1)
| fields - data _raw _time