topic Re: XML field extraction in Splunk Search

XML field extraction

anooshac — Mon, 25 Oct 2021 05:32:53 GMT

Hi all, I have a xml file as below.

<?xml version="1.0" encoding="UTF-8"?>

The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this?

|spath output=cases path=suite.case{@name}| table cases

This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

Re: XML field extraction

ITWhisperer — Mon, 25 Oct 2021 10:25:32 GMT

You could try something like this - expand the empty cases to the full XML syntax, then extract the cases into separate events, then extract the attributes from each event

| makeresults | eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\"?> <suite name=\"abc\" timestamp=\"20.08.2021 15:47:20\" hostname=\"kkt2si\" tests=\"5\" failures=\"1\" errors=\"1\" time=\"0\"> <case name=\"a\" time=\"626\" classname=\"x\"> <failure message=\"failed\" /> </case> <case name=\"b\" time=\"427\" classname=\"x\" /> <case name=\"C\" time=\"616\" classname=\"y\" /> <case name=\"d\" time=\"626\" classname=\"y\"> <error message=\"error\" /> </case> <case name=\"e\" time=\"621\" classname=\"x\" /> </suite>" | rex mode=sed max_match=0 "s/(?P<case>\<case )(?P<attr>[^\/\>]+)\/\>/\1\2><\/case>/g" | rex max_match=0 "(?ms)(?<case>\<case .+?\<\/case\>)" | mvexpand case | spath input=case output=name path=case{@name} | spath input=case output=failed path=case.failure{@message} | spath input=case output=error path=case.error{@message}

Re: XML field extraction

anooshac — Mon, 25 Oct 2021 11:24:33 GMT

Hi sir,

Thank you so much for the reply.. It works great..

Is there any way that i can merge error and failed into a single column called status? So that i can represent status in a single column?

Re: XML field extraction

ITWhisperer — Mon, 25 Oct 2021 11:30:26 GMT

| eval status=coalesce(failed, error)

Re: XML field extraction

anooshac — Mon, 25 Oct 2021 12:05:51 GMT

yes.. Got it.. Thank you so much..