combine xml log, two search and value to field

jangid — Mon, 15 Oct 2012 16:45:28 GMT

My two xml log looks like this

<items><item><name>Registered Users</name><value>139</value></item><item><name>Registered Internet Users</name><value>0</value></item><item><name>Connected Users</name><percent>0</percent><value>60 / 500</value></item><item><name>Connected Internet Users</name><percent>0</percent><value>0 / 0</value></item></items></tec>

Search for this

sourcetype=log_system "[SYSTEM]" "Registered Users" | head 1 | table name, value

Search Result for this is

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0

AND another log

StatusRunningRH12R12 ReleaseR12System Date04-Dec-2000OS ReleaseLinux

search for this log

sourcetype=log_system "[SYSTEM]" "Status" | head 1 | table name, value

Search Result for this is

name                    value
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I combine these two results and How do I want to convert these value to fields?

My result should be similar this

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I convert these value to fields?
e.g.

Registered_Users    Registered_Internet_Users   OS_Release
61                  0                            Linux

Thanks

Re: combine xml log, two search and value to field

stefandagerman — Mon, 15 Oct 2012 16:50:08 GMT

Have you tried an OR clause in your search, like so:

sourcetype=log_system "[SYSTEM]" ("Registered Users" OR "Status") | head 1 | table name, value

Re: combine xml log, two search and value to field

jangid — Mon, 15 Oct 2012 16:52:24 GMT

Yes, due to head only one result will display.
I want to head 1 from both search.

topic Re: combine xml log, two search and value to field in Splunk Search

combine xml log, two search and value to field

Re: combine xml log, two search and value to field

Re: combine xml log, two search and value to field