Dashboards & Visualizations

how to mvexpand a 3 node level xml or merge it with xpath or spath ?

sbsbb
Builder

I have xml with 3 level

level1 Property1
EventType1
Element1
Element2

EventType2
Element3
Element4

level1 Property2
EventType1
Element5
Element6

EventType2
Element7
Element8

I would like to have everything flat like :
Level1 Property1 EventType1 Element1 (... with all fields from Element1)
Level1 Property1 EventType1 Element2...
Level1 Property1 EventType2 Element3...
Level1 Property1 EventType2 Element4...
Level1 Property2 EventType1 Element5...

I tried to make an spath with Level1 as path, and then a | mvexpand
But in fact I have to make a double expand for each eventtype, or make somekind of union ?

(fields in the Elements itself are similar in Event1 and 2)

I'm lost !

0 Karma

sbsbb
Builder

At the moment I've a workaround by doing an append

search.... spath... [ append search spath ]

It works, but it is not really performant.

0 Karma

eashwar
Communicator

did you have a solution for this brother, please let me know

0 Karma
Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...