topic Re: Extract multiple field values from XML in Splunk in Splunk Search

Extract multiple field values from XML in Splunk

shangshin — Tue, 11 Dec 2012 15:38:51 GMT

Hi,
Please advise the splunk search to extract multiple field values from the xml in splunk.
For example, how can I get both the user name and user id using the sample xml below.

<users>
  <user>
    <user_name>John Jobs</user_name>
   <user_id>JJobs</user_id>
   <user_iemail>JJobs@example.com</user_email>
</user>
 <user>
    <user_name>Mary Ann</user_name>
   <user_id>mann</user_id>
   <user_iemail>mann@outlook.com</user_email>
 </user>
</users>

Re: Extract multiple field values from XML in Splunk

sdaniels — Tue, 11 Dec 2012 18:24:06 GMT

You can use the spath command to get the values that you want. See the xml examples towards the bottom.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Spath

You can also have Splunk extract all fields automatically for you:

http://splunk-base.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs

Re: Extract multiple field values from XML in Splunk

shangshin — Tue, 11 Dec 2012 19:45:51 GMT

Thank you! This is very helpful.

I am able to extract most of the elements except for the element value with forward slash.

E.g.
the xml element below users.usr.url returns an empty value.
/en-GB/app/search/flashtimeline?q=search sourcetype

Is there a special function for this?

Re: Extract multiple field values from XML in Splunk

sdaniels — Tue, 11 Dec 2012 19:47:45 GMT

Maybe you can update the XML to show what you are talking about. Right now it's hard to tell why it's not working for you.