How to extract multi-valued fields from XML?

[tamakg]

I have a XML file with multi values on a specific tag (below).

I need to extract the attributes (NAME and CLASSORIGIN) and the VALUE , ignoring the rows without the tag VALUE.

I loaded the file as a XML and I was able to convert this to a multi-line result but now I need to extract the fields. Any ideas?

[tamakg · Accepted solution]

Solved it.

index=msperf sourcetype="perfmon_processor_xml"
| xpath outfield=Architecture "//COMMAND/RESULTS/CIM/INSTANCE/PROPERTY"
| where Architecture != "Null"
| table Architecture
| mvexpand Architecture
| rex field=Architecture "^[^=\n]=\"(?P\w+)[^=\n]=\"(?P[^\"]+)[^<\n]*<\w+>(?P\w+)"

[sudosplunk]

Did you try using spath. Append |spath at the end of your search and see if it works for you.

[tamakg]

Yes, I did for some reason the fields could not be extracted.

appending only | spath doesn't show me nothing different. When I try
index=msperf sourcetype="perfmon_processor_xml"
| xpath outfield=Architecture "//COMMAND/RESULTS/CIM/INSTANCE/PROPERTY"
| mvexpand Architecture
| table Architecture
| where Architecture != "Null"
| spath
| rename PROPERTY.VALUE as Value
| rename PROPERTY.{@NAME} as Name
| table Name Value

the search results nothing. Maybe I'm missing something on the rename command.

[sudosplunk]

Give it a shot index=msperf sourcetype="perfmon_processor_xml" |spath

[tamakg]

index=msperf sourcetype="perfmon_processor_xml"
| spath
| rename COMMAND.RESULTS.CIM.INSTANCE.PROPERTY.VALUE as Value
| rename COMMAND.RESULTS.CIM.INSTANCE.PROPERTY{@NAME} as Name
| table Name Value

Returned a single row with 2 multi-line fields, but the problem is: some rows doesn't have the VALUE tag and the columns have a different number of values.