topic Re: spath vs xpath parse xml in Splunk Search

spath vs xpath parse xml

indeed_2000 — Sun, 03 Oct 2021 10:21:16 GMT

i have xml file like this, how can i table it with xpath or spath?

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<error-codes>
<error-code code="000" message="Exceeded" severity="1" InfoCode="0000" action="" description=""/>
<error-code code="001" message="Not Found" severity="1" InfoCode="0000" action="" description=" nope"/>
</error-codes>

</info>

excpected output:

.... | table code message severity InfoCode action description

Re: spath vs xpath parse xml

ITWhisperer — Sun, 03 Oct 2021 11:44:29 GMT

Firstly split error-codes into separate events, then extract all the field attributes, then create new fields based on the attribute name

| makeresults | eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?> <info xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"> <error-codes> <error-code code=\"000\" message=\"Exceeded\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\"\"/> <error-code code=\"001\" message=\"Not Found\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\" nope\"/> </error-codes> </info>" | spath path="info.error-codes" output=errorcodes | eval _raw=errorcodes | multikv noheader=t | table _raw | spath | foreach "error-code{@*}" [| eval _name="<<MATCHSEG1>>" | eval {_name}='<<FIELD>>'] | rename error-code* as _error-code* | table code message severity InfoCode action description

Re: spath vs xpath parse xml

indeed_2000 — Sun, 03 Oct 2021 15:28:59 GMT

@ITWhisperer Thank you for answer

i can see it successfuly extract fields from xml file, when i run this spl ....| table _raw

but no result when I run this ....| table code message severity InfoCode action description

here is the full spl

index="my-index" source="/home/file.xml" | spath path="info.error-codes" output=errorcodes | eval _raw=errorcodes | multikv noheader=t | table _raw | spath | foreach "error-code{@*}" [| eval _name="<<MATCHSEG1>>" | eval {_name}='<<FIELD>>'] | rename error-code* as _error-code* | table code message severity InfoCode action description

Re: spath vs xpath parse xml

ITWhisperer — Sun, 03 Oct 2021 14:55:49 GMT

You haven't got a closing double quote around your index name?

Re: spath vs xpath parse xml

indeed_2000 — Sun, 03 Oct 2021 15:29:58 GMT

when i copy here accidentally removed, corect spl have double quotes.

I modify last reply.

any other idea?

Re: spath vs xpath parse xml

ITWhisperer — Sun, 03 Oct 2021 16:51:24 GMT

What do you get without the last table line?

Re: spath vs xpath parse xml

indeed_2000 — Sun, 03 Oct 2021 20:50:19 GMT

after some workaround it work,I try to remove file and add with custom source type. finally table return result.

Thanks,