topic Re: How to extract multi-valued fields from XML? in Dashboards & Visualizations

How to extract multi-valued fields from XML?

tamakg — Fri, 24 Aug 2018 19:31:52 GMT

I have a XML file with multi values on a specific tag (below).

I need to extract the attributes (NAME and CLASSORIGIN) and the VALUE , ignoring the rows without the tag VALUE.

I loaded the file as a XML and I was able to convert this to a multi-line result but now I need to extract the fields. Any ideas?

Re: How to extract multi-valued fields from XML?

sudosplunk — Fri, 24 Aug 2018 19:37:17 GMT

Did you try using spath. Append |spath at the end of your search and see if it works for you.

Re: How to extract multi-valued fields from XML?

tamakg — Tue, 29 Sep 2020 20:59:47 GMT

Yes, I did for some reason the fields could not be extracted.

appending only | spath doesn't show me nothing different. When I try
index=msperf sourcetype="perfmon_processor_xml"
| xpath outfield=Architecture "//COMMAND/RESULTS/CIM/INSTANCE/PROPERTY"
| mvexpand Architecture
| table Architecture
| where Architecture != "Null"
| spath
| rename PROPERTY.VALUE as Value
| rename PROPERTY.{@NAME} as Name
| table Name Value

the search results nothing. Maybe I'm missing something on the rename command.

Re: How to extract multi-valued fields from XML?

sudosplunk — Fri, 24 Aug 2018 19:48:32 GMT

Give it a shot index=msperf sourcetype="perfmon_processor_xml" |spath

Re: How to extract multi-valued fields from XML?

tamakg — Tue, 29 Sep 2020 20:59:50 GMT

index=msperf sourcetype="perfmon_processor_xml"
| spath
| rename COMMAND.RESULTS.CIM.INSTANCE.PROPERTY.VALUE as Value
| rename COMMAND.RESULTS.CIM.INSTANCE.PROPERTY{@NAME} as Name
| table Name Value

Returned a single row with 2 multi-line fields, but the problem is: some rows doesn't have the VALUE tag and the columns have a different number of values.

Re: How to extract multi-valued fields from XML?

tamakg — Tue, 29 Sep 2020 20:59:56 GMT

Solved it.

index=msperf sourcetype="perfmon_processor_xml"
| xpath outfield=Architecture "//COMMAND/RESULTS/CIM/INSTANCE/PROPERTY"
| where Architecture != "Null"
| table Architecture
| mvexpand Architecture
| rex field=Architecture "^[^=\n]=\"(?P\w+)[^=\n]=\"(?P[^\"]+)[^<\n]*<\w+>(?P\w+)"