https://community.splunk.com/t5/Splunk-Search/XML-multivalue-field-extraction/m-p/66699#M16613 <P>Hi mzorzi</P> <P>I cannot test it, but I would try to use <CODE>spath</CODE> with your XML like this</P> <PRE><CODE>... | spath output=gln path=contentOwner.gln </CODE></PRE> <P>see <CODE>spath</CODE> examples here <A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Spath#Examples">http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Spath#Examples</A></P> <P>cheers, MuS</P> Tue, 18 Jun 2013 13:48:28 GMT MuS 2013-06-18T13:48:28Z https://community.splunk.com/t5/Splunk-Search/XML-multivalue-field-extraction/m-p/66698#M16612 <P>My XML file looks like ( I have added spaces for formatting )</P> <P>&lt; contentOwner&gt; </P><P><BR /> &lt; gln&gt;113456789&lt; /gln&gt;<BR /> </P><P><BR /> &lt; contentOwner&gt; </P><P><BR /> &lt; gln&gt;1423456791&lt; /gln&gt; </P><P><BR /> &lt; /contentOwner&gt; </P><P><BR /> &lt; contentOwner&gt; </P><P><BR /> &lt; gln&gt;193456795 </P><P><BR /> &lt; /contentOwner&gt;</P> <P>and I want to extract a single multi event fields GLN=113456789,1423456791,193456795</P> <P></P><P></P> <P>How can I do that?</P> Tue, 18 Jun 2013 09:58:21 GMT https://community.splunk.com/t5/Splunk-Search/XML-multivalue-field-extraction/m-p/66698#M16612 mzorzi 2013-06-18T09:58:21Z https://community.splunk.com/t5/Splunk-Search/XML-multivalue-field-extraction/m-p/66699#M16613 <P>Hi mzorzi</P> <P>I cannot test it, but I would try to use <CODE>spath</CODE> with your XML like this</P> <PRE><CODE>... | spath output=gln path=contentOwner.gln </CODE></PRE> <P>see <CODE>spath</CODE> examples here <A href="http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Spath#Examples">http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Spath#Examples</A></P> <P>cheers, MuS</P> Tue, 18 Jun 2013 13:48:28 GMT https://community.splunk.com/t5/Splunk-Search/XML-multivalue-field-extraction/m-p/66699#M16613 MuS 2013-06-18T13:48:28Z