<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Extract Table in Event in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531482#M8608</link>
    <description>&lt;P&gt;It's the same like above except that the prices has multiple decimal places after the comma.&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;data type="info" text="sales:
    VW;1;30.000;
    Bentley;1;70.000,000000;
    Seat;1;15.000,000000;
   Dacia;1;10.000,000000;
   Fiat;1;20.000,000000;
"&amp;gt;
&amp;lt;customer&amp;gt;Mr.X&amp;lt;/customer&amp;gt;
&amp;lt;time&amp;gt;2020-11-28 16:21:00&amp;lt;/time&amp;gt;
&amp;lt;/data&amp;gt;&lt;/LI-CODE&gt;</description>
    <pubDate>Tue, 01 Dec 2020 10:00:17 GMT</pubDate>
    <dc:creator>RobertRi</dc:creator>
    <dc:date>2020-12-01T10:00:17Z</dc:date>
    <item>
      <title>Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531237#M8597</link>
      <description>&lt;P&gt;Hi Community!&lt;/P&gt;&lt;P&gt;I have a problem to extract a table in an XML event.&lt;/P&gt;&lt;P&gt;The data looks like this&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;data type="info" text="sales:
    VW;1;30.000;
    Bentley;1;70.000;
    Seat;1;15.000;
   Dacia;1;10.000;
   Fiat;1;20.000;
"&amp;gt;
&amp;lt;customer&amp;gt;Mr.X&amp;lt;/customer&amp;gt;
&amp;lt;time&amp;gt;2020-11-28 16:21:00&amp;lt;/time&amp;gt;
&amp;lt;/data&amp;gt;&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;&lt;BR /&gt;Now I want to have the fields for cartype, quantity and price (VW;1;30.000;).&lt;BR /&gt;So that I can summarize the whole sellings from one day.&lt;BR /&gt;Could you please help me with that?&lt;BR /&gt;&lt;BR /&gt;Thank you very much!&lt;BR /&gt;Rob&lt;/P&gt;</description>
      <pubDate>Sat, 28 Nov 2020 15:26:07 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531237#M8597</guid>
      <dc:creator>RobertRi</dc:creator>
      <dc:date>2020-11-28T15:26:07Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531239#M8598</link>
      <description>&lt;LI-CODE lang="markup"&gt;| spath path="data{@text}" output=sales
| rex field=sales max_match=0 "\n\s+(?&amp;lt;cartype&amp;gt;[^;]+);(?&amp;lt;quantity&amp;gt;\d+);(?&amp;lt;price&amp;gt;[^;]+);"&lt;/LI-CODE&gt;</description>
      <pubDate>Sat, 28 Nov 2020 16:52:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531239#M8598</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-11-28T16:52:09Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531288#M8599</link>
      <description>&lt;P&gt;Thank you very much!&lt;/P&gt;</description>
      <pubDate>Mon, 30 Nov 2020 08:14:59 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531288#M8599</guid>
      <dc:creator>RobertRi</dc:creator>
      <dc:date>2020-11-30T08:14:59Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531460#M8606</link>
      <description>&lt;P&gt;HI ITWhisperer!&lt;/P&gt;&lt;P&gt;Thank you very much for your answer, whith it I have an overview about my data.&lt;/P&gt;&lt;P&gt;Now I have a second question, regarding the prices.&lt;BR /&gt;It seems if there are more than 1 matches, the data will be stored like an array in the field.&lt;BR /&gt;If I export it to an csv it looks like this:&lt;/P&gt;&lt;P&gt;VW,2,30.000,0000&lt;BR /&gt;25.000,0000,&lt;BR /&gt;&lt;BR /&gt;I have tried to round the price to a 2 digit value after the comma, but this does not work.&lt;/P&gt;&lt;P&gt;How can I grab each item in the field and modify it with an eval command?&lt;/P&gt;&lt;P&gt;Regards&lt;BR /&gt;Robert&lt;/P&gt;</description>
      <pubDate>Tue, 01 Dec 2020 08:13:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531460#M8606</guid>
      <dc:creator>RobertRi</dc:creator>
      <dc:date>2020-12-01T08:13:13Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531477#M8607</link>
      <description>&lt;P&gt;What does the XML look like in this instance?&lt;/P&gt;</description>
      <pubDate>Tue, 01 Dec 2020 09:48:08 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531477#M8607</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-12-01T09:48:08Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531482#M8608</link>
      <description>&lt;P&gt;It's the same like above except that the prices has multiple decimal places after the comma.&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;&amp;lt;data type="info" text="sales:
    VW;1;30.000;
    Bentley;1;70.000,000000;
    Seat;1;15.000,000000;
   Dacia;1;10.000,000000;
   Fiat;1;20.000,000000;
"&amp;gt;
&amp;lt;customer&amp;gt;Mr.X&amp;lt;/customer&amp;gt;
&amp;lt;time&amp;gt;2020-11-28 16:21:00&amp;lt;/time&amp;gt;
&amp;lt;/data&amp;gt;&lt;/LI-CODE&gt;</description>
      <pubDate>Tue, 01 Dec 2020 10:00:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531482#M8608</guid>
      <dc:creator>RobertRi</dc:creator>
      <dc:date>2020-12-01T10:00:17Z</dc:date>
    </item>
    <item>
      <title>Re: Extract Table in Event</title>
      <link>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531483#M8609</link>
      <description>&lt;LI-CODE lang="markup"&gt;| spath path="data{@text}" output=sales
| rex field=sales max_match=0 "\n\s+(?&amp;lt;cartype&amp;gt;[^;]+);(?&amp;lt;quantity&amp;gt;\d+);(?&amp;lt;price&amp;gt;[^;,]+);"&lt;/LI-CODE&gt;&lt;P&gt;Just add a comma to the exclusion list for the price.&lt;/P&gt;</description>
      <pubDate>Tue, 01 Dec 2020 10:02:55 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Extract-Table-in-Event/m-p/531483#M8609</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-12-01T10:02:55Z</dc:date>
    </item>
  </channel>
</rss>

