topic Re: Using xpath queries on events that contain text and xml in Splunk Search

Using xpath queries on events that contain text and xml

Mikey_C — Thu, 18 Nov 2010 07:18:12 GMT

Hello, So xpath feature is great, but I have this issue. We deal with XML messaging from our customers and would like to extract some field data using xpath queries to run stats. I was able to create a field extraction that will pull out xml message, but I can't figure out how to tell Splunk to perform the xpath query on an extracted field.

Here's what a sample event looks like this:

20101117 161059.999 DEBUG[D] clpr ZZZ:[PROD ZZZ|FIXML3-ReaderThread-105] :CMBSource ZZZ|FIXML3, Underlying Source=[WeblogicJmsSource PROD_XXXX_JMSServer/PROD_XXX!ZZZ_FIXML_IN, TxMode=2] read MessageID 5540635964843910837 --> 
DESTINATION_NAME=
SOURCE_NAME=FIXML3
CORRELATION_ID=5540644259047556424
JMSXDeliveryCount=1
Payload(String)=<?xml version="1.0" encoding="UTF-8"?><FIXML><AllocRptAck MsgEvtSrc="MQM" TxnTm="2010-11-17T16:10:59-06:00" InptDev="API" RptTyp="9" RptID="2" ID="123456" TransTyp="0" TrdDt="2010-11-17"><Hdr Snt="2010-11-17T16:10:59-06:00"/><Pty ID="CBT" R="22"></Pty></AllocAck></AllocRptAck></FIXML>

I created a field extraction that takes everything between the two FIXML tags and creates a field, but cannot figure out how to execute xpath queries on this in Splunk. It is a valid XML but how do I tell splunk to just use that field I've identified so that I can use xpath. Note: xmlkv won't work for this because of the nature of the messages as seen above.

Thanks! -Mike

Re: Using xpath queries on events that contain text and xml

OL — Thu, 18 Nov 2010 15:47:57 GMT

I tried to work with XML and xpath but so far without full success. I started to create my own function for it but it's very far to be finished. But this is probably because I'm haven't used the product for a long time. Have you tried to use rex? For instance, rex (?.*) or something similar to extract what you need. Hope that helps.

Re: Using xpath queries on events that contain text and xml

Mikey_C — Fri, 19 Nov 2010 01:01:28 GMT

I know I could write a regular expression to get the field out of the XML, but it would be nice to use xpath queries so I could after different types of data.

Re: Using xpath queries on events that contain text and xml

ftk — Fri, 03 Dec 2010 04:13:26 GMT

According to the documentation for the xpath command, you should be able to use it on your field as such:

your search | xpath field=your_field "//blah/node"