Dashboards & Visualizations

how to exctract fields from nested named XML elements

swe
Path Finder

hi there,
i have xml files which are indexed with KV_MODE=xml. i want to stats on the values on datagroup name="mem-used-percent"

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<myobjects-sensor-data ms-duration="3244">
    <ident>0820958kjshf8</ident>
    <timeTimeDate>2017-04-30 23:55:15</timeTimeDate>
    <csp>true</csp>
    <sensors>
        <sensor name="mem-data" status="INFO" duration-ms="2">
            <sensorData>
                <datagroup name="mem-used-percent">
                    <probe>
                        <key>value</key>
                        <value>25.4</value>
                    </probe>
                </datagroup>
            </sensorData>
        </sensor>
        <sensor name="anotherone" status="INFO" duration-ms="2">
            <sensorData>
........
            </sensorData>
        </sensor>
    </sensors>
</myobjects-sensor-data>

the sensor data gets recognized in preview for example:
myobjects-sensor-data.sensors.sensor.sensorData.datagroup.probe.value = 25.4

but as there are multiple *probe.value i dont know how to exactly adress this value by the name of the "datagroup".

...| spath output=memdaten path="myobjects-sensor-data.sensors.sensor{@name="mem-data"}.datagroup{@name="mem-used-percent"}.probe.value"

wont work.

what am i doing wrong?

thanks
swe

Tags (1)
0 Karma
1 Solution

swe
Path Finder

hi there,

one possible solution is a combination of KV_MODE=xml, rex and mvzip. for example:

eval sensorstatuses=mvzip('myobject-sensor-data.sensors.sensor{@name}','myobject-sensor-data.sensors.sensor{@status}') 
| rex "<key>gps-latitude<\/key>\s*<value>(?<gps_latitude>.*)<\/value>"

its not nice, but works for now until someone comes up with a better solution
thanks
swe

View solution in original post

0 Karma

swe
Path Finder

hi there,

one possible solution is a combination of KV_MODE=xml, rex and mvzip. for example:

eval sensorstatuses=mvzip('myobject-sensor-data.sensors.sensor{@name}','myobject-sensor-data.sensors.sensor{@status}') 
| rex "<key>gps-latitude<\/key>\s*<value>(?<gps_latitude>.*)<\/value>"

its not nice, but works for now until someone comes up with a better solution
thanks
swe

0 Karma

swe
Path Finder

HI,

shouldnt it be possible with xpath? i tried but this did not work. any suggestions?

xpath "//myobject-sensor-data/sensors/sensor[@name='mem-data']/datagroup[@name='mem-used-percent']/probe/value" outfield=myfield

0 Karma

niketn
Legend

Instead of name it will be based on number if you are using spath

| spath output=memdaten path="myobjects-sensor-data.sensors.sensor{1}.datagroup.probe.value"

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#6:_Extract_a_subset_of_a_XM...

If you have already defined KV_MODE=xml in your sourcetype, you can table all the required field names as separate columns and then perform search/filter

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

swe
Path Finder

thanks, adressing with a number works but if the structure changes this would not be realy reliable. so i wonder if there is a better solution.

if using table i get a massive ammount of multivalue fields, in which i cant identifiy to which keys the values belong..

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...