https://community.splunk.com/t5/Splunk-Search/How-to-append-XML-from-subsearch/m-p/148531#M41530 <P>I'm trying to append xmlkv results to my original search string. Here is what I've tried, and what is not working.</P> <PRE><CODE>index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id | eval XML_SRC=("/opt/elemental_se/web/log/*/job_"+JobID+"/*_emecmd.xml") | convert timeformat="%H%M%S" mktime(completed_at) mktime(started_at) | fieldformat completed_at=strftime(completed_at,"%H:%M:%S") | fieldformat started_at=strftime(started_at,"%H:%M:%S") | eval TimeDiff=completed_at-started_at | eval JobLength=strftime(TimeDiff, "%M:%S") | append [ search source=XML_SRC "&lt;command value='job'&gt;" | xmlkv ] </CODE></PRE> <P>Is the XML_SRC going to work in a subsearch like that? Any suggestions on how to achieve this? If anything, I'd like to obtain just one result of the xmlkv in the subsearch. It's named file_size. But there is a bunch more I'd like to eventually include, so I figured just bringing it all in as extra fields would be best.</P> Mon, 28 Sep 2020 18:21:14 GMT helius 2020-09-28T18:21:14Z https://community.splunk.com/t5/Splunk-Search/How-to-append-XML-from-subsearch/m-p/148531#M41530 <P>I'm trying to append xmlkv results to my original search string. Here is what I've tried, and what is not working.</P> <PRE><CODE>index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval JobID=id | eval XML_SRC=("/opt/elemental_se/web/log/*/job_"+JobID+"/*_emecmd.xml") | convert timeformat="%H%M%S" mktime(completed_at) mktime(started_at) | fieldformat completed_at=strftime(completed_at,"%H:%M:%S") | fieldformat started_at=strftime(started_at,"%H:%M:%S") | eval TimeDiff=completed_at-started_at | eval JobLength=strftime(TimeDiff, "%M:%S") | append [ search source=XML_SRC "&lt;command value='job'&gt;" | xmlkv ] </CODE></PRE> <P>Is the XML_SRC going to work in a subsearch like that? Any suggestions on how to achieve this? If anything, I'd like to obtain just one result of the xmlkv in the subsearch. It's named file_size. But there is a bunch more I'd like to eventually include, so I figured just bringing it all in as extra fields would be best.</P> Mon, 28 Sep 2020 18:21:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-XML-from-subsearch/m-p/148531#M41530 helius 2020-09-28T18:21:14Z https://community.splunk.com/t5/Splunk-Search/How-to-append-XML-from-subsearch/m-p/148532#M41531 <P>I was able to figure this out. Here is the final result:</P> <PRE><CODE>[ search index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | eval source=("/opt/elemental_se/web/log/*/job_"+id+"/*_emecmd.xml") | table source ] | rex field=source "job_(?&lt;JobID&gt;\d+)" | search "&lt;command value='job'&gt;" | xmlkv | stats count by JobID, file_size | appendcols [ search index=content_eng source="dbmon-tail://kemgr-a1p/Jobs General" | convert timeformat="%H%M%S" mktime(completed_at) mktime(started_at) | fieldformat completed_at=strftime(completed_at,"%H:%M:%S") | fieldformat started_at=strftime(started_at,"%H:%M:%S") | eval TimeDiff=completed_at-started_at | eval JobLength=strftime(TimeDiff, "%M:%S") ] | table id started_at completed_at JobLength file_size </CODE></PRE> <P><IMG src="http://i.imgur.com/cONxloG.jpg" alt="alt text" title="Title" /></P> Thu, 18 Dec 2014 22:48:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-append-XML-from-subsearch/m-p/148532#M41531 helius 2014-12-18T22:48:17Z