Dashboards & Visualizations
Highlighted

Not able to extract the NAME1 value from XML file

Explorer

Hi ALL,

we are trying to get data from below XML file , go to node SSL1DF and under SSL1DF if value of PARVW="AG", then pick the value of NAME1 and display it in a table. i have tried with below query but didn't received what i'm looking , could you please provide the search query to get the value.

Search Query:

index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_AS2_F4F_ShipNoticeInvoiceOutbound_MPGW | xpath outfield=NAME2 "//E1EDKA2[PARVW=\"AG\"]NAME2" | table NAME2

XML file.

AG
0030128356267702
D6320
configuration message

Tags (1)
0 Karma
Highlighted

Re: Not able to extract the NAME1 value from XML file

Explorer

Please find the attached XML filealt text

0 Karma
Highlighted

Re: Not able to extract the NAME1 value from XML file

Legend

You need to parse to PARVW and NAME1 nodes separately and then pipe your search condition for both the fields i.e.
(PS: I personally prefer spath over xpath as I am more comfortable with spath syntax)
Your query example does not show XML being extracted. If you already do not have a field containing XML data extract the same using rex. Since detail is not present in example, I am assuming xml data field name as xml_data for the following example. (also assuming E1EDKA2 is the root node as per your sample data/query, if not please change path accordingly):

 <Your Base Search>
| spath input=xml_data output=PARVW path=E1EDKA2.PARVW 
| spath input=xml_data output=NAME1 path=E1EDKA2.NAME1 
| search PARVW="AG"
| table NAME1 



| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Not able to extract the NAME1 value from XML file

Legend

@lksridhar... Were you able to test the answer? Also since you have posted a screenshot of Ship To Data, I would recommend mocking or masking the data.




| eval message="Happy Splunking!!!"


0 Karma