<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Extraction of Response values from XML in the desired way. in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495098#M32412</link>
    <description>&lt;P&gt;HI Ravi,&lt;/P&gt;

&lt;P&gt;Please find the sample xml. I want to map the data and display as shown in the second picture. &lt;/P&gt;</description>
    <pubDate>Tue, 12 May 2020 10:38:54 GMT</pubDate>
    <dc:creator>yamini_37</dc:creator>
    <dc:date>2020-05-12T10:38:54Z</dc:date>
    <item>
      <title>Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495094#M32408</link>
      <description>&lt;P&gt;Hi All,&lt;/P&gt;

&lt;P&gt;I am trying to extract the multiple response values for a single request. After using "spath" command,  the result is shown below.&lt;BR /&gt;
Here, I didn't extract any values and just tabulated the needed information.  &lt;IMG src="https://community.splunk.com/storage/temp/290670-before-extraction.png" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;So, in the XML file, ALB city has 4 streets. Each street contains 4 members. This is single result . Now I want to break it as 16 results with all details as shown below.&lt;/P&gt;

&lt;P&gt;&lt;IMG src="https://community.splunk.com/storage/temp/290671-after-extraction.png" alt="alt text" /&gt;&lt;/P&gt;

&lt;P&gt;My query looks like &lt;BR /&gt;
index=ab host=xy source=*y.xml |spath |table _time host City_Name Street_name Person_code Person_role&lt;/P&gt;

&lt;P&gt;The above query gave the results shown in the first pic. Now i want to get the results as shown in the second picture. Please help me in framing the query for the latter part to get the expected results. &lt;/P&gt;

&lt;P&gt;Thank You.&lt;/P&gt;</description>
      <pubDate>Wed, 30 Sep 2020 05:23:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495094#M32408</guid>
      <dc:creator>yamini_37</dc:creator>
      <dc:date>2020-09-30T05:23:02Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495095#M32409</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;Can you post sample XML?&lt;/P&gt;</description>
      <pubDate>Fri, 08 May 2020 04:40:51 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495095#M32409</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-08T04:40:51Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495096#M32410</link>
      <description>&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval City_name="ALB"
| eval Street_name=split("Street 1,Street 2,Street 3,Street 4",",")
| eval Person_code=split("1,2,3,4",",")
| eval Person_role=split("Father,Mother,Brother,Sister,Father,Mother,Brother,Sister,Father,Mother,Brother,Sister,Father,Mother,Brother,Sister",",")
| table City_name Street_name Person_code Person_role
| rename COMMENT as "this is your sample. please check this. from here, the logic"

| eval Person_role=mvdedup(Person_role)
| eval Person=mvzip(Person_code,Person_role)
| mvexpand Street_name
| stats values(City_name) as City_name list(Street_name) as Street_name by Person
| mvexpand Street_name
| eval Person_code=mvindex(split(Person,","),0), Person_role=mvindex(split(Person,","),1)
| fields - Person
| table City_name Street_name Person_code Person_role
| sort Street_name
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Fri, 08 May 2020 05:22:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495096#M32410</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-08T05:22:18Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495097#M32411</link>
      <description>&lt;P&gt;JSON:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| makeresults
| eval _raw="{\"City Name\":\"ALB\",\"Street name\":[\"street 1\",\"street 2\",\"street 3\",\"street 4\"],\"Person code\":[1,2,3,4],\"Person role\":[\"Father\",\"Mother\",\"Brother\",\"Sister\",\"Father\",\"Mother\",\"Brother\",\"Sister\",\"Father\",\"Mother\",\"Brother\",\"Sister\",\"Father\",\"Mother\",\"Brother\",\"Sister\"]}"
| spath
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;what's &lt;EM&gt;XML&lt;/EM&gt; ?&lt;/P&gt;</description>
      <pubDate>Fri, 08 May 2020 06:41:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495097#M32411</guid>
      <dc:creator>to4kawa</dc:creator>
      <dc:date>2020-05-08T06:41:25Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495098#M32412</link>
      <description>&lt;P&gt;HI Ravi,&lt;/P&gt;

&lt;P&gt;Please find the sample xml. I want to map the data and display as shown in the second picture. &lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 10:38:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495098#M32412</guid>
      <dc:creator>yamini_37</dc:creator>
      <dc:date>2020-05-12T10:38:54Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495099#M32413</link>
      <description>&lt;P&gt;I couldn't able to share the xml here&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 10:53:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495099#M32413</guid>
      <dc:creator>yamini_37</dc:creator>
      <dc:date>2020-05-12T10:53:25Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495100#M32414</link>
      <description>&lt;P&gt;please find below.&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 10:54:20 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495100#M32414</guid>
      <dc:creator>yamini_37</dc:creator>
      <dc:date>2020-05-12T10:54:20Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495101#M32415</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;

&lt;P&gt;Still, it is missing&lt;/P&gt;</description>
      <pubDate>Tue, 12 May 2020 11:09:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495101#M32415</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-12T11:09:26Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495102#M32416</link>
      <description>&lt;P&gt;I have posted a new question and tagged you. Could you please check.  The subject line of the question is "challenge!!! extraction of XML response values"&lt;/P&gt;</description>
      <pubDate>Wed, 13 May 2020 08:04:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495102#M32416</guid>
      <dc:creator>yamini_37</dc:creator>
      <dc:date>2020-05-13T08:04:13Z</dc:date>
    </item>
    <item>
      <title>Re: Extraction of Response values from XML in the desired way.</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495103#M32417</link>
      <description>&lt;P&gt;I not able to find, can you post the URL?&lt;/P&gt;</description>
      <pubDate>Wed, 13 May 2020 08:18:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Extraction-of-Response-values-from-XML-in-the-desired-way/m-p/495103#M32417</guid>
      <dc:creator>vnravikumar</dc:creator>
      <dc:date>2020-05-13T08:18:25Z</dc:date>
    </item>
  </channel>
</rss>

