Not able to extract the NAME1 value from XML file

[lksridhar]

Hi ALL,

we are trying to get data from below XML file , go to node SSL1DF and under SSL1DF if value of PARVW="AG", then pick the value of NAME1 and display it in a table. i have tried with below query but didn't received what i'm looking , could you please provide the search query to get the value.

Search Query:

index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_AS2_F4F_ShipNoticeInvoiceOutbound_MPGW | xpath outfield=NAME2 "//E1EDKA2[PARVW=\"AG\"]NAME2" | table NAME2

XML file.

AG
0030128356267702
D6320
configuration message

[niketn]

You need to parse to PARVW and NAME1 nodes separately and then pipe your search condition for both the fields i.e.
(PS: I personally prefer spath over xpath as I am more comfortable with spath syntax)
Your query example does not show XML being extracted. If you already do not have a field containing XML data extract the same using rex. Since detail is not present in example, I am assuming xml data field name as xml_data for the following example. (also assuming E1EDKA2 is the root node as per your sample data/query, if not please change path accordingly):

 <Your Base Search>
| spath input=xml_data output=PARVW path=E1EDKA2.PARVW 
| spath input=xml_data output=NAME1 path=E1EDKA2.NAME1 
| search PARVW="AG"
| table NAME1 

[niketn]

@lksridhar... Were you able to test the answer? Also since you have posted a screenshot of Ship To Data, I would recommend mocking or masking the data.

[lksridhar]

Please find the attached XML file