Dashboards & Visualizations

How to extract multi value field from XML?

Explorer

I want to build a multi value field from my XML. Checking out both the documentation and the answers I figure out I should use spath instead of xmlkv. However, the provided examples did not work for my case. So let me share what I did in order to allow you to point where is my mistake or a better new option, please.

Here is an example of my XML:
alt text

And here is the search I tried:
... | spath output=parameterNumber path=Request.RequestParameter.parameterNumber | spath output=parameterValue path=Request.RequestParameter.parameterValue

Thanks in advance!

Regards,

Tiago

Tags (3)
0 Karma
1 Solution

Legend

Have you tried regex? Like this

... | rex max_match=0 field=fieldwithxmldata "Number\>(?<nbr>\d+).*[\n\r]*.*.*\>(?<val>\w+)" | eval z=mvzip(nbr, val) | mvexpand z | rex field=z "(?<nbr>[^,]+),(?<val>.*)"

View solution in original post

0 Karma

Legend

Have you tried regex? Like this

... | rex max_match=0 field=fieldwithxmldata "Number\>(?<nbr>\d+).*[\n\r]*.*.*\>(?<val>\w+)" | eval z=mvzip(nbr, val) | mvexpand z | rex field=z "(?<nbr>[^,]+),(?<val>.*)"

View solution in original post

0 Karma

Explorer

Worked, thank you! 🙂

0 Karma

Explorer

Just complementing, I think I can't set KV_MODE = xml in my props.conf as sugested in * https://answers.splunk.com/answers/227887/how-to-extract-multivalue-fields-from-xml-data-at.html * because the events are not XML-formated, but the XML is into one particular field in some events.

0 Karma

Explorer

I also tryed the following and did not work...

... | xmlkv | table ID, TS, Name, Request.RequestParameter.parameterNumber, Request.RequestParameter.parameterValue

😞

0 Karma