Getting Data In

Extracting value from XML tags

sushma6
New Member

Hi,

Can you help me out in extracting information between the XML tags and perform division operation on it.

In my XML file I have something called 24 , this is one event and other event is 6

Now I need to extract the filesize value i.e. 24 and transtime value i.e. 6 and want to perform divison of filesize/transtime and splunk needs to show the output value i.e. 24/6=4.

I tried out using xmlkv and spath, it is not working out.

Can you help!

Cheers,
Sushma.

Tags (1)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

One possibility is to use an inline rex or EXTRACT via props.conf. The inline rex(s) would look something like this:

<your base search> | rex "\<filesize\>\s*(?<fsize>\d+)\s*\<\/filesize\>" | rex "\<transtime\>\s*(?<ttime>\d+)\s*\<\/transtime\>" | eval avgtime=fsize/ttime

Out of curiosity, what sort of trouble are you having with xmlkv and spath?

MuS
Legend

Hi sushma6,

something like this should work:

... | spath | eval myDevision=filesize/transtime | table myDevision

This is because when spath is called with no path argument, spath runs in "auto-extract" mode, where it finds and extracts all the fields from the first 5000 characters in the input field which defaults to _raw if another input source isn't specified.

If spathreally does not work, you could try some regex to get the fields like this:

... | rex "\<filesize\>\s(?<myFilesize>\d+)\s.+\<transtime\>\s(?<myTranstime>\d+)\s" | eval myDevision=myFilesize/myTranstime | table myDevision

btw, are you aware that there are some spaces around the numeric values or is this just a copy/paste error?
In your case you can remove spaces from values like this:

... | spath | eval myFilesize=ltrim(filesize) | eval myTranstime=ltrim(transtime) | eval myDevision=myFilesize/myTranstime | table myDevision

hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...