Get specific data in xml as result of query, Using JAVA API

monanimihir — Tue, 22 Sep 2015 11:48:57 GMT

Suppose i create a Query and its output in XML contains 100+ elements(to be specific , using JAVA API). As per my need there are only few fields(like 4-5 out of 100+) that is important.

When i apply a query and get result as XML , it will be 100+ fields in one result . But i want to get only 3-4 fields as result out of 100+ elements.

As an example , consider this XML output file :-

<?xml version='1.0' encoding='UTF-8'?>
<results preview='0'>
<meta>
<fieldOrder>
<field>_bkt</field>
<field>_cd</field>
<field>_indextime</field>
<field>_raw</field>
<field>_serial</field>
<field>_si</field>
<field>_sourcetype</field>
<field>_subsecond</field>
<field>_time</field>
<field>host</field>
<field>index</field>
<field>linecount</field>
<field>source</field>
<field>sourcetype</field>
<field>splunk_server</field>
</fieldOrder>
</meta>
    <result offset='0'>
        <field k='_bkt'>
            <value><text>_internal~7731~1DBA39FA-6647-46E3-B469-CAF7DC0DF495</text></value>
        </field>
        <field k='_cd'>
            <value><text>7731:26146</text></value>
        </field>
        <field k='_indextime'>
            <value><text>1442903467</text></value>
        </field>
        <field k='_serial'>
            <value><text>0</text></value>
        </field>
        <field k='_si'>
            <value><text>shared-logsearch3-3-crz_logsearch_1</text></value>
            <value><text>_internal</text></value>
        </field>
        <field k='_sourcetype'>
            <value><text>splunkd_access</text></value>
        </field>
        <field k='_subsecond'>
            <value><text>.128</text></value>
        </field>
        <field k='_time'>
            <value><text>2015-09-22T06:31:07.128+00:00</text></value>
        </field>
        <field k='index'>
            <value><text>_internal</text></value>
        </field>
        <field k='linecount'>
            <value><text>1</text></value>
        </field>
        <field k='source'>
            <value><text>/home/logsearch_2/logs/splunk/splunkd_access.log</text></value>
        </field>
        <field k='sourcetype'>
            <value><text>splunkd_access</text></value>
        </field>
        <field k='splunk_server'>
            <value><text>Random_server_Name</text></value>
        </field>
    </result>
</results>

From above XML file i need only 4 fields as result but what i am getting is more than 10 fields.

Is there any way to limit output of query?

I am doing all of this using JAVA API, not with Splunk UI

Re: Get specific data in xml as result of query, Using JAVA API

monanimihir — Wed, 23 Sep 2015 06:02:30 GMT

got the answer from another Question from Splunk:-

http://answers.splunk.com/answers/80810/run-a-search-and-retrieve-elements-from-a-splunk-api-in-java.html

Re: Get specific data in xml as result of query, Using JAVA API

monanimihir — Thu, 10 Dec 2015 10:21:44 GMT

got the answer from another Question from Splunk:-

http://answers.splunk.com/answers/80810/run-a-search-and-retrieve-elements-from-a-splunk-api-in-java.html

topic Re: Get specific data in xml as result of query, Using JAVA API in Dashboards & Visualizations

Get specific data in xml as result of query, Using JAVA API

Re: Get specific data in xml as result of query, Using JAVA API

Re: Get specific data in xml as result of query, Using JAVA API