how extract fields from XML maintaining alignment if same tags are repeated?

marcoemme41 — Fri, 15 Mar 2019 17:31:46 GMT

I have an XML with some tags repetead and other tags not repeated. I need extract all fields from this XML maintaining corrispondence between all tags.

I can explain using the example reported in Splunk docs for spath command (https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Spath):

This is my XML and the query to extract fields:

The output of this query is:

This is wrong because "Clarke" is associated to "A Clash of Kings" instead to "Jonathan Strange".
What I need, instead, is Martin repeated in the first and second lines of Author column, and Clarke written in third line.

Someone can help me?

Re: how extract fields from XML maintaining alignment if same tags are repeated?

niketn — Sun, 17 Mar 2019 15:18:17 GMT

@marcoemme41, ideally if you are interested in <book> being the root node of individual events and not <purchases> you should try to index only <book> node and discard <publisher> node by pushing to null queue:
props.conf

BREAK_ONLY_BEFORE=\<book\>
MUST_BREAK_AFTER=\<\/book\>
KV_MODE=xml
TRANSFORMS-nullQueueDiscardPurchases=nullQueueDiscardPurchases

transforms.conf

[nullQueueDiscardPurchases]
REGEX = purchases
DEST_KEY = queue
FORMAT = nullQueue

However, as per your question following is searchtime. Consider this only as workaround, since, ideal way would to ingest the data in proper way as expected.

| makeresults
| eval _raw="
<purchases>
  <book>
    <author>Martin</author>
    <title>A Game of Thrones</title>
    <title>A Clash of Kings</title>
  </book>
  <book>
    <author>Clarke</author>
    <title>Jonathan Strange</title>
  </book>
</purchases>"
| spath input=_raw path=purchases
| eval purchases=replace(purchases,"</book>","</book>|")
| makemv purchases delim="|"
| mvexpand purchases
| rename purchases as _raw
| spath

topic Re: how extract fields from XML maintaining alignment if same tags are repeated? in Dashboards & Visualizations

how extract fields from XML maintaining alignment if same tags are repeated?

Re: how extract fields from XML maintaining alignment if same tags are repeated?