topic Re: Multivalue to single value from XML in Splunk Search

How to create a multivalue to single value from XML?

cmcdole — Mon, 13 Mar 2023 13:30:55 GMT

I need to create a single field named MemberOf from the XML snippet below. It should look like this:

memberOf

CN=Buttercup,OU=SAP Service Accounts and Groups,OU=Service Accounts,DC=corp,DC=Buttercup,DC=com

CN=Corp-Hypr,OU=Hypr,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=Everyone - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=Contractors – Buttercup- Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=Contractors – US – Buttercup- Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=ButtercupLocation - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=Everyone - M to Q - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=O365-Buttercup,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=Contractors - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com

CN=Buttercup-MNOPQ,OU=CIT-WS,OU=Groups,DC=corp,DC=Buttercup,DC=com

Re: Multivalue to single value from XML

bowesmana — Fri, 10 Mar 2023 01:12:42 GMT

Assuming _raw holds the XML snippet

| spath path=entry.value.Map.entry{@key} output=memberOf

Re: Multivalue to single value from XML

richgalloway — Fri, 10 Mar 2023 01:21:54 GMT

Maybe this run-anywhere example will get you started.

| makeresults | eval _raw="<entry key=\"memberOf\"> <value> <Map> <entry key=\"CN=Buttercup Location - Group,OU=SharePoint,OU=Groups,DC=corp,DC=buttercup,DC=com\"/> <entry key=\"CN=Contractors - Group,OU=SharePoint,OU=Groups,DC=corp,DC=buttercup,DC=com\"/> <entry key=\"CN=Contractors – Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=buttercup,DC=com\"/> <entry key=\"CN=Contractors – US – Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Corp-Hypr,OU=Hypr,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Everyone - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Everyone - Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=O365-Buttercup2,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Buttercup ,OU=SAP Service Accounts and Groups,OU=Service Accounts,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Buttercup-MNOPQ,OU=CIT-WS,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> </Map> </value> </entry>" ``` Above is demo data. Delete IRL. ``` | spath output=Map path=entry.value.Map | spath input=Map output=values path=entry{@key} | eval key="memberOf" | table key values

Re: Multivalue to single value from XML

cmcdole — Fri, 10 Mar 2023 13:16:25 GMT

Your awesomeness is much appreciated. This works!! Thank you very much!!

Re: Multivalue to single value from XML

richgalloway — Fri, 10 Mar 2023 15:04:34 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.