Dashboard creation

[splunk6]

Hi 

I have a xml response in splunk whenever i query a index.I used to get the error msg in 

</soap:Envelope>", RESPONSE="<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header/> <soapenv:Body> <soapenv:Fault xmlns:trefault="http://tresoap.intecbilling.com/fault/2.0"> <faultcode>trefault:ApplicationException</faultcode> <faultstring><CM-41398> ERROR: Value &quot;Apple Watch 4G 5GB&quot; supplied for Fact &quot;OrderedComp.RatePlan_R&quot; is not allowed by the fact&apos;s filter search or expression</faultstring> <detail> <trefault:Detail> <trefault:Message><CM-41398> ERROR: Value &quot;Apple Watch 4G 5GB&quot; supplied for Fact &quot;OrderedComp.RatePlan_R&quot; is not allowed by the fact&apos;s filter search or expression</trefault:Message> <trefault:ErrorId>41398</trefault:ErrorId> </trefault:Detail> </detail> </soapenv:Fault> </soapenv:Body>

Can someone tell me how to extract this error msg from the xml and display the error msg in a seperate panel as table in dashboard 

[splunk6]

when i run the above query, am getting "invalid arguement near innisbrook"

[richgalloway]

Weird typo is fixed.

[splunk6]

i want the error messgae from "faultstring" to be displayed in my results:

</soap:Envelope>", RESPONSE="<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Header></soap:Header> <soap:Body> <soap:Fault> <faultcode>soap:Server</faultcode> <faultstring>APPL0014: IO Exception: Read timed out java.net.SocketTimeoutException: Read timed out</faultstring> </soap:Fault> </soap:Body>

My splunk query is below:

index="abc" source="xyz" OPERATION = "getOrderService"
|rex "RESPONSE=\\\"(?<RESPONSE>.+)"
|spath input=RESPONSE
|spath input=RESPONSE output=faultstring path=soapenv:Envelope.soap:Header.soapenv:Body.soapenv:Fault.faultcode.faultstring

instead of fetching only one response with faultstring, its fetching all the results from the responses

[richgalloway]

That's what Splunk does - it fetches all of the events that meet the search criteria.  If you want a single response then put that in the SPL using head 1, tail 1, dedup or something similar.

[splunk6]

but then also its fetching all the responses from the results instead of faultstring only it s not filtering out the responses based on that tag

[richgalloway]

Use the spath command to parse the XML then select the desired field.  If spath doesn't work, it's because the XML is not valid.  You may need to strip out excess quotes.

[splunk6]

if i give the below query to extract the error msg alone from the soap response:

index="abcl" sourcetype="oracle:transactionlog" OPERATION = "getOrderService"
|rex "REQUEST=\"(?<REQUEST>.+)\", RESPONSE=\"(?<RESPONSE>.+)\", RETRYNO"
|spath input=RESPONSE
|spath input=RESPONE output=trefault:Message path=trefault:Message

am getting no response

[richgalloway]

There are no results because the rex command is not extracting any fields.  That's because it is looking for text ("REQUEST" and "RETRYNO") that don't exist (at least not in the sample event).  This run-anywhere query works for me.

| makeresults 
| eval _raw="</soap:Envelope>\", RESPONSE=\"<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\"> <soapenv:Header/> <soapenv:Body> <soapenv:Fault xmlns:trefault=\"http://tresoap.intecbilling.com/fault/2.0\"> <faultcode>trefault:ApplicationException</faultcode> <faultstring><CM-41398> ERROR: Value &quot;Apple Watch 4G 5GB&quot; supplied for Fact &quot;OrderedComp.RatePlan_R&quot; is not allowed by the fact&apos;s filter search or expression</faultstring> <detail> <trefault:Detail> <trefault:Message><CM-41398> ERROR: Value &quot;Apple Watch 4G 5GB&quot; supplied for Fact &quot;OrderedComp.RatePlan_R&quot; is not allowed by the fact&apos;s filter search or expression</trefault:Message> <trefault:ErrorId>41398</trefault:ErrorId> </trefault:Detail> </detail> </soapenv:Fault> </soapenv:Body>"
|rex "RESPONSE=\\\"(?<RESPONSE>.+)"
|spath input=RESPONSE
|spath input=RESPONSE output=trefault:Message path=soapenv:Envelope.soapenv:Body.soapenv:Fault.faultstring.detail.trefault:Detail.trefault:Message