https://community.splunk.com/t5/Splunk-Search/Join-multiple-fields-from-xml/m-p/419165#M120503 <P>I want to join these different product_id's from an XML file into one table:</P> <PRE><CODE>&lt;product_detail&gt; &lt;product_id&gt;1003C&lt;/product_id&gt; &lt;product_detail&gt; &lt;product_id&gt;1002C&lt;/product_id&gt; &lt;/product_detail&gt; </CODE></PRE> <P>Example: 1003C,1002C</P> <P>I've tried split, mvjoin, spath, and nothing works. Here's sample of my query:<BR /> source=xxxxxx.log<BR /> | xmlkv <BR /> | spath input=product_id<BR /> | table product_id<BR /> | eval product_id=split(product_id,";") <BR /> | eval product_id=mvjoin(product_id,";") </P> <P>How do I get the output of these multiple values into a semi-colon?</P> Tue, 29 Sep 2020 19:41:46 GMT roblr052 2020-09-29T19:41:46Z https://community.splunk.com/t5/Splunk-Search/Join-multiple-fields-from-xml/m-p/419165#M120503 <P>I want to join these different product_id's from an XML file into one table:</P> <PRE><CODE>&lt;product_detail&gt; &lt;product_id&gt;1003C&lt;/product_id&gt; &lt;product_detail&gt; &lt;product_id&gt;1002C&lt;/product_id&gt; &lt;/product_detail&gt; </CODE></PRE> <P>Example: 1003C,1002C</P> <P>I've tried split, mvjoin, spath, and nothing works. Here's sample of my query:<BR /> source=xxxxxx.log<BR /> | xmlkv <BR /> | spath input=product_id<BR /> | table product_id<BR /> | eval product_id=split(product_id,";") <BR /> | eval product_id=mvjoin(product_id,";") </P> <P>How do I get the output of these multiple values into a semi-colon?</P> Tue, 29 Sep 2020 19:41:46 GMT https://community.splunk.com/t5/Splunk-Search/Join-multiple-fields-from-xml/m-p/419165#M120503 roblr052 2020-09-29T19:41:46Z https://community.splunk.com/t5/Splunk-Search/Join-multiple-fields-from-xml/m-p/419166#M120504 <P>@roblr052, your sample XML data seems incorrect. Your first <CODE>&lt;product_detail&gt;</CODE> does not have an end node. I am not sure if that is how the data is or whether it was a type while posting the sample data here.</P> <P>Following is a run anywhere example with corrected sample data and <CODE>spath</CODE> command:</P> <PRE><CODE>| makeresults | eval _raw="&lt;data&gt; &lt;product_detail&gt; &lt;product_id&gt;1003C&lt;/product_id&gt; &lt;/product_detail&gt; &lt;product_detail&gt; &lt;product_id&gt;1002C&lt;/product_id&gt; &lt;/product_detail&gt; &lt;/data&gt;" | spath </CODE></PRE> <P>Please try out and confirm. </P> <P>If correct xml data is indexed, then either <CODE>KV_MODE=xml</CODE> should be used to get xml fields extracted automatically during search time field discovery.</P> Fri, 25 May 2018 19:05:02 GMT https://community.splunk.com/t5/Splunk-Search/Join-multiple-fields-from-xml/m-p/419166#M120504 niketn 2018-05-25T19:05:02Z