topic Multi XML Field Extraction in Splunk Search

Multi XML Field Extraction

tyronetv — Mon, 14 Jan 2013 15:48:12 GMT

Given an entry like below, my goal is to pull all the "fieldName" parameters, essentially recreating the "where" clause being submitted to the database. I would want the output to be along the lines of

_time RID fieldName#1 fieldName#2 fieldName...., Or

2013-01-14 07:32:13.182 | 1358177533172-2801682 | Process Date | Applied Amount

2013-01-14 07:32:13,182 INFO [ndler-RMICallHandler-4364] RID=1358177533172-2801682 c.r.t.services.AbstractServiceWsImpl - {USER ID} -- {SERVICE METHOD} SearchRequest {REQUESTED} <?xml version = '1.0' encoding = 'UTF-8'?> ----Process Date2013-01-112013-01-11Applied Amount4742.814742.81

Any suggestions ?

Re: Multi XML Field Extraction

jonuwz — Sun, 20 Jan 2013 12:39:10 GMT

spath will munch your XML into splunk fields.

i.e.

... | spath path=searchrequest.callinguserid.applicationid.searchparams.searchparam.fieldname output=fieldnames 
| eval fieldnames=mvjoin(fieldnames,",")

So we're saying, in the xml, get all the instances of searchrequest.callinguserid.applicationid.searchparams.searchparam.fieldname, and put it in a field called fieldnames.

This is a multivalue field, so we join the values with a ','

Re: Multi XML Field Extraction

tyronetv — Tue, 22 Jan 2013 14:37:30 GMT

I used the following:

... | spath path=searchRequest.callingUserId.applicationId.searchParams.searchParam.fieldName output=fieldnames |eval fieldnames=mvjoin(fieldnames,",")

As I read the documentation on spath the letter case is important (or not, but I tried) but even this did not pull the fields as I would of hoped. As a matter of fact no fields were identified.

Re: Multi XML Field Extraction

jonuwz — Wed, 23 Jan 2013 13:41:39 GMT

what happens if you just run it through | spath ?