topic How do I parse my XML data in a single search? in Splunk Search

How do I parse my XML data in a single search?

i2sheri — Fri, 02 Oct 2015 09:52:38 GMT

I've an xml wth below structure

<root><stats>
    <total>
        <stat pass="12" fail="12">C</stat>
        <stat pass="12" fail="12">A</stat>
    </total>
    <tag>
        <stat pass="2" fail="4">X</stat>
        <stat pass="10 fail="8">Y</stat>
    </tag>
    <more-sets/>
</stats></root>

What I need

...| table type fail pass

I can get this separately with below search (replace total with tag and so on)

base search | table root.stats.total.stat* | rename root.stats.total.stat{@*} as * 
| eval temp=mvzip('root.stats.total.stat', mvzip(fail, pass, "#"), "#")  | table temp | mvexpand temp 
| rex field=temp "(?<Total>.*)#(?<Fail>.*)#(?<Pass>.*)" | fields Total Fail Pass

Is there a way to do it in single search ?

Re: How do I parse my XML data in a single search?

somesoni2 — Fri, 02 Oct 2015 18:04:45 GMT

You current search is already a single search (no subsearch/append etc). Could you be more specific on what you're looking for? May be a sudo query that you expect.

Re: How do I parse my XML data in a single search?

i2sheri — Mon, 05 Oct 2015 02:53:50 GMT

I want below from total/tag( or any other tag in ) in one search query
C 12 12
A 12 12
X 4 8
Y 8 10
with out joining above queries

Re: How do I parse my XML data in a single search?

woodcock — Tue, 06 Oct 2015 13:45:25 GMT

I do not understand your question but have you tried spath?

http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/spath

Re: How do I parse my XML data in a single search?

somesoni2 — Tue, 06 Oct 2015 14:18:57 GMT

Try something like this

your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,(mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail

Re: How do I parse my XML data in a single search?

i2sheri — Fri, 09 Oct 2015 08:42:09 GMT

I am new to splunk, I will try and let you know

Re: How do I parse my XML data in a single search?

i2sheri — Fri, 09 Oct 2015 08:50:59 GMT

Small correction, I cannot edit your answer

 your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail