Extract and addition of values from an XML log file

a523504 — Thu, 18 Apr 2013 16:11:23 GMT

Hi, I have been trying to extract valuesd from an XMl log file but failing so far.

2
3
4

This is the string I was using:
Source = 'Sheep' | xmlkv count NumberOfSheep

Could anyone please offer me some help,
thanks for your help.

Re: Extract and addition of values from an XML log file

emechler_splunk — Thu, 18 Apr 2013 19:57:38 GMT

Your XML is malformed; the closing tags should be </numberofsheep> as such:

<numberofsheep>2</numberofsheep>
<numberofsheep>3</numberofsheep>
<numberofsheep>4</numberofsheep>

Once you have that, you can use the xmlkv command (or the new spath command) to extract the field:

source = 'Sheep' | xmlkv

...and then use stats to sum up the values:

source = 'Sheep' | xmlkv | stats sum(numberofsheep)