we are trying to get data from below XML file , go to node SSL1DF and under SSL1DF if value of PARVW="AG", then pick the value of NAME1 and display it in a table. i have tried with below query but didn't received what i'm looking , could you please provide the search query to get the value.
index=datapower host=mq-tst sourcetype=mq ServiceName=SC_GLOBAL_B2B_AS2_F4F_ShipNoticeInvoiceOutbound_MPGW | xpath outfield=NAME2 "//E1EDKA2[PARVW=\"AG\"]NAME2" | table NAME2
You need to parse to PARVW and NAME1 nodes separately and then pipe your search condition for both the fields i.e.
(PS: I personally prefer spath over xpath as I am more comfortable with spath syntax)
Your query example does not show XML being extracted. If you already do not have a field containing XML data extract the same using rex. Since detail is not present in example, I am assuming xml data field name as xml_data for the following example. (also assuming E1EDKA2 is the root node as per your sample data/query, if not please change path accordingly):
<Your Base Search> | spath input=xml_data output=PARVW path=E1EDKA2.PARVW | spath input=xml_data output=NAME1 path=E1EDKA2.NAME1 | search PARVW="AG" | table NAME1
@lksridhar... Were you able to test the answer? Also since you have posted a screenshot of Ship To Data, I would recommend mocking or masking the data.