https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113568#M29904 <P>Sample xml</P> Tue, 24 Mar 2015 21:50:33 GMT premdutt 2015-03-24T21:50:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113563#M29899 <P>Hi<BR /> Could you please help me on the below request?</P> <P>I would like to extract fields like <CODE>RETURNMESSAGE</CODE>, <CODE>ORIGINALFILENAME</CODE> , <CODE>STATE</CODE> and their corresponding values. The search below did not give me any result. </P> <PRE><CODE>| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name} </CODE></PRE> Tue, 24 Mar 2015 03:12:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113563#M29899 premdutt 2015-03-24T03:12:07Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113564#M29900 <P>sample xml</P> Tue, 24 Mar 2015 03:13:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113564#M29900 premdutt 2015-03-24T03:13:44Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113565#M29901 <P>The sample seems to be missing..</P> Tue, 24 Mar 2015 03:21:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113565#M29901 ramdaspr 2015-03-24T03:21:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113566#M29902 <P>Can you please share the sample xml?</P> <P>Thanks!</P> Tue, 24 Mar 2015 12:39:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113566#M29902 vganjare 2015-03-24T12:39:06Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113567#M29903 <P>can you show example or send your xml fine??<BR /> thank.</P> Tue, 24 Mar 2015 12:58:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113567#M29903 fdi01 2015-03-24T12:58:25Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113568#M29904 <P>Sample xml</P> Tue, 24 Mar 2015 21:50:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113568#M29904 premdutt 2015-03-24T21:50:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113569#M29905 <P>@premdutt<BR /> Use the 'Code Sample' button (5th button on the textbox menu while you write a comment) to paste the xml else the code is stripped out. </P> Tue, 24 Mar 2015 23:19:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113569#M29905 ramdaspr 2015-03-24T23:19:39Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113570#M29906 <P>YES send it please</P> Wed, 25 Mar 2015 18:09:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113570#M29906 fdi01 2015-03-25T18:09:16Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113571#M29907 <P>Thank you Experts, i was struggling on adding the sample. <BR /> Please find the sample xml.</P> <PRE><CODE>&lt;TrkDescriptor&gt; &lt;TrkXML VERSION="1.0"/&gt; &lt;TrkObject&gt; &lt;TrkAttr name="DIRECTION" val="S"/&gt; &lt;TrkAttr name="SSLCYPHER" val="A"/&gt; &lt;TrkAttr name="ISSSL" val="0"/&gt; &lt;TrkAttr name="ISALERT" val="0"/&gt; &lt;/TrkObject&gt; &lt;/TrkDescriptor&gt; </CODE></PRE> Thu, 26 Mar 2015 22:28:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113571#M29907 premdutt 2015-03-26T22:28:34Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113572#M29908 <P>Hi,</P> <P>What sourcetype did you use? I used the "<STRONG>log4net_xml</STRONG>" as sourcetype and used above query. It worked fine.</P> <P>| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name}</P> <P>Gave following AttributeNames:</P> <PRE><CODE>DIRECTION 1 100% ISALERT 1 100% ISSSL 1 100% SSLCYPHER 1 100% </CODE></PRE> <P>Thanks!!</P> Mon, 30 Mar 2015 12:04:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113572#M29908 vganjare 2015-03-30T12:04:31Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113573#M29909 <P>And how to filter results to only show the TrkAttr name when the TrkAttr val is = 0?<BR /> The output should be<BR /> ISSSL<BR /> ISALERT</P> <P>Thanks!</P> Thu, 21 Jan 2016 20:28:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113573#M29909 fabioportes 2016-01-21T20:28:54Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113574#M29910 <P>Did you ever figure this out?</P> Thu, 13 Sep 2018 13:04:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-XML-attribute-names-and-corresponding-values/m-p/113574#M29910 gregbo 2018-09-13T13:04:36Z