https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/536010#M151526 <P>Excellent! Thank you so much!</P> Fri, 15 Jan 2021 14:21:42 GMT 4uramana4u 2021-01-15T14:21:42Z https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/535957#M151507 <P>eval FunctionalRef=spath(_raw,"n2:EvtMsg.Bd.BOEvt.Evt.DatElGrp{2}.DatEl.Val") -&gt; I am getting two(2) values&nbsp;DHL5466256965140262WH3,&nbsp;DE4608089.&nbsp;&nbsp;</P><P>Instead I should get only&nbsp;DHL5466256965140262WH3.&nbsp; So this value is not static</P><P>XML Snippet:</P><P>&lt;DatElGrp Cd="CommonGrp"&gt;<BR />&lt;DatEl&gt;<BR />&lt;Cd&gt;FunctionalRef&lt;/Cd&gt;<BR />&lt;Val&gt;DHL5466256965140262WH3&lt;/Val&gt;<BR />&lt;/DatEl&gt;<BR />&lt;DatEl&gt;<BR />&lt;Cd&gt;DeclarantID&lt;/Cd&gt;<BR />&lt;Val&gt;DE4608089&lt;/Val&gt;<BR />&lt;/DatEl&gt;<BR />&lt;/DatElGrp&gt;<BR /><BR /></P> Fri, 15 Jan 2021 07:44:33 GMT https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/535957#M151507 4uramana4u 2021-01-15T07:44:33Z https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/535999#M151521 <LI-CODE lang="markup">index=_internal | head 1 | fields _raw | eval _raw="&lt;DatElGrp Cd=\"CommonGrp\"&gt; &lt;DatEl&gt; &lt;Cd&gt;FunctionalRef&lt;/Cd&gt; &lt;Val&gt;DHL5466256965140262WH3&lt;/Val&gt; &lt;/DatEl&gt; &lt;DatEl&gt; &lt;Cd&gt;DeclarantID&lt;/Cd&gt; &lt;Val&gt;DE4608089&lt;/Val&gt; &lt;/DatEl&gt; &lt;/DatElGrp&gt;" | spath | rename DatElGrp{@Cd} as GrpCd, DatElGrp.* as * | foreach DatEl.* [ eval &lt;&lt;FIELD&gt;&gt; = mvindex('&lt;&lt;FIELD&gt;&gt;' , 0)]</LI-CODE> Fri, 15 Jan 2021 12:44:45 GMT https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/535999#M151521 to4kawa 2021-01-15T12:44:45Z https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/536007#M151525 <LI-CODE lang="markup">index=_internal | head 1 | fields _raw | eval _raw="&lt;DatElGrp Cd=\"CommonGrp\"&gt; &lt;DatEl&gt; &lt;Cd&gt;FunctionalRef&lt;/Cd&gt; &lt;Val&gt;DHL5466256965140262WH3&lt;/Val&gt; &lt;/DatEl&gt; &lt;DatEl&gt; &lt;Cd&gt;DeclarantID&lt;/Cd&gt; &lt;Val&gt;DE4608089&lt;/Val&gt; &lt;/DatEl&gt; &lt;/DatElGrp&gt;" | spath DatElGrp.DatEl.Cd{1} | spath DatElGrp.DatEl.Val{1}</LI-CODE> Fri, 15 Jan 2021 13:27:07 GMT https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/536007#M151525 to4kawa 2021-01-15T13:27:07Z https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/536010#M151526 <P>Excellent! Thank you so much!</P> Fri, 15 Jan 2021 14:21:42 GMT https://community.splunk.com/t5/Splunk-Search/XML-field-extraction-with-spath/m-p/536010#M151526 4uramana4u 2021-01-15T14:21:42Z