Dashboards & Visualizations

Extract multiple fieds with spath or xpath


I was not able to find a way to extract at one time multiple values from an xml file

if I look in the doc, It seems not to be possible to make a
| spath field=xml path=event1 | table event2 evente3 event4.subevent ...

I have each time to define every field, is that true ?

| spath field=xml path=event1 | spath field=xml path=event2 | spath field=xml path=event4.subevent ...

For any reason xmlkv, is making the all structure flat, (doesn't matter on where it is placed before or behind), so its not an option...


Does multiple spath option work? Have you set KV_MODE = xml in your props.conf setting?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>