I have part of an xml file which looks like this:
<Field name="Name1" type="string" length="16">
<Comments>
<p/>Value 1
</Comments>
</Field>
<Field name="Name2" type="string" length="8">
<Comments>
<p/>Value 2:
<ul>
<li>Value 2a</li>
<li>Value 2b</li>
</ul>
</Comments>
I am trying to make a field called Comments with all the text inside the Comments tag for each Field tag.
Example:
For Name1, Comments="Value 1"
For Name2, Comments="Value 2: Value 2a Value2b
In the case of Name2, how do I capture the list as well as the paragraph?
I have tried spath path=...Field.Comments but that only captures the <p>
.
have you tried xpath instead?
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Xpath
it still might be tricky to get all of them under comments, but what if you just tried |xpath outfield=Comments "//Field/Comments"
have you tried xpath instead?
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Xpath
it still might be tricky to get all of them under comments, but what if you just tried |xpath outfield=Comments "//Field/Comments"
Thanks. That worked to capture everything inside the Comments. I then removed the tags to get my desired result: | rex field=Comments mode=sed "s/\<((\w|\/)+)\>//g"