topic How to extract multi value field from XML? in Dashboards & Visualizations

How to extract multi value field from XML?

tcmarquesi — Wed, 05 Oct 2016 16:23:35 GMT

I want to build a multi value field from my XML. Checking out both the documentation and the answers I figure out I should use spath instead of xmlkv. However, the provided examples did not work for my case. So let me share what I did in order to allow you to point where is my mistake or a better new option, please.

Here is an example of my XML:

And here is the search I tried:
... | spath output=parameterNumber path=Request.RequestParameter.parameterNumber | spath output=parameterValue path=Request.RequestParameter.parameterValue

Thanks in advance!

Regards,

Tiago

Re: How to extract multi value field from XML?

tcmarquesi — Wed, 05 Oct 2016 16:41:12 GMT

I also tryed the following and did not work...

... | xmlkv | table ID, TS, Name, Request.RequestParameter.parameterNumber, Request.RequestParameter.parameterValue

😞

Re: How to extract multi value field from XML?

tcmarquesi — Wed, 05 Oct 2016 17:29:03 GMT

Just complementing, I think I can't set KV_MODE = xml in my props.conf as sugested in * https://answers.splunk.com/answers/227887/how-to-extract-multivalue-fields-from-xml-data-at.html * because the events are not XML-formated, but the XML is into one particular field in some events.

Re: How to extract multi value field from XML?

sundareshr — Wed, 05 Oct 2016 17:59:30 GMT

Have you tried regex? Like this

... | rex max_match=0 field=fieldwithxmldata "Number\>(?<nbr>\d+).*[\n\r]*.*.*\>(?<val>\w+)" | eval z=mvzip(nbr, val) | mvexpand z | rex field=z "(?<nbr>[^,]+),(?<val>.*)"

Re: How to extract multi value field from XML?

tcmarquesi — Wed, 05 Oct 2016 20:12:05 GMT

Worked, thank you! 🙂