Dashboards & Visualizations

Not able to extract the NAME1 value from XML file

lksridhar
Explorer

Hi ALL,

we are trying to get data from below XML file , go to node SSL1DF and under SSL1DF if value of PARVW="AG", then pick the value of NAME1 and display it in a table. i have tried with below query but didn't received what i'm looking , could you please provide the search query to get the value.

Search Query:

index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_AS2_F4F_ShipNoticeInvoiceOutbound_MPGW | xpath outfield=NAME2 "//E1EDKA2[PARVW=\"AG\"]NAME2" | table NAME2

XML file.

AG
0030128356267702
D6320
configuration message

Tags (1)
0 Karma

niketn
Legend

You need to parse to PARVW and NAME1 nodes separately and then pipe your search condition for both the fields i.e.
(PS: I personally prefer spath over xpath as I am more comfortable with spath syntax)
Your query example does not show XML being extracted. If you already do not have a field containing XML data extract the same using rex. Since detail is not present in example, I am assuming xml data field name as xml_data for the following example. (also assuming E1EDKA2 is the root node as per your sample data/query, if not please change path accordingly):

 <Your Base Search>
| spath input=xml_data output=PARVW path=E1EDKA2.PARVW 
| spath input=xml_data output=NAME1 path=E1EDKA2.NAME1 
| search PARVW="AG"
| table NAME1 
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@lksridhar... Were you able to test the answer? Also since you have posted a screenshot of Ship To Data, I would recommend mocking or masking the data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

lksridhar
Explorer

Please find the attached XML filealt text

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...