Dashboards & Visualizations

Not able to extract the NAME1 value from XML file

lksridhar
Explorer

Hi ALL,

we are trying to get data from below XML file , go to node SSL1DF and under SSL1DF if value of PARVW="AG", then pick the value of NAME1 and display it in a table. i have tried with below query but didn't received what i'm looking , could you please provide the search query to get the value.

Search Query:

index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_AS2_F4F_ShipNoticeInvoiceOutbound_MPGW | xpath outfield=NAME2 "//E1EDKA2[PARVW=\"AG\"]NAME2" | table NAME2

XML file.

AG
0030128356267702
D6320
configuration message

Tags (1)
0 Karma

niketn
Legend

You need to parse to PARVW and NAME1 nodes separately and then pipe your search condition for both the fields i.e.
(PS: I personally prefer spath over xpath as I am more comfortable with spath syntax)
Your query example does not show XML being extracted. If you already do not have a field containing XML data extract the same using rex. Since detail is not present in example, I am assuming xml data field name as xml_data for the following example. (also assuming E1EDKA2 is the root node as per your sample data/query, if not please change path accordingly):

 <Your Base Search>
| spath input=xml_data output=PARVW path=E1EDKA2.PARVW 
| spath input=xml_data output=NAME1 path=E1EDKA2.NAME1 
| search PARVW="AG"
| table NAME1 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@lksridhar... Were you able to test the answer? Also since you have posted a screenshot of Ship To Data, I would recommend mocking or masking the data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

lksridhar
Explorer

Please find the attached XML filealt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...