spath xml parsing

glasserd17 — Wed, 18 Jul 2012 18:14:16 GMT

I'm trying to extract the "user.name" field from the XML below (in pastebin). However, I can't seem to write an spath command that will do it. I was wondering if anyone could help me out. I'm wondering if my issue is that my tags have periods in them.

http://pastebin.com/0g83eBY8

Re: spath xml parsing

vincesesto — Wed, 10 Oct 2012 23:51:54 GMT

Hey gloasserd17,

I think you are on the right track with thinking you naming conventions are the issue. I have just been looking at your xml data and it looks like splunk is getting mixed up with the period in between the tag elements, and I can only think that the best option would be to create a rex to search for the username values instead. Like the one below:

index=main sourcetype="TestXML" | head 10000 | rex "(?i)\\.name>(?P<FIELDNAME>[^<]+)" | top 50 FIELDNAME

You can then do what you want with the data. You could also extract this information through props.conf at index time.

I hope this helped.

Regards vince

topic spath xml parsing in Splunk Search

spath xml parsing

Re: spath xml parsing