Getting Data In

How to return xml grouped by parent element?

sboogaar
Path Finder

I want to convert my _raw xml data in a query to a list of parent with an mv field of children.
Lets say the structure looks like this:

<elements>
   <element>
     <name>element one</name>
     <items>
         <item> 1   </item>
         <item> 2   </item>
         <item> 3   </item>
     </items>    
   </element>

   <element>
     <name>element two</name>
     <items>
         <item> 4   </item>
         <item> 9   </item>
     </items>    
   </element>
</elements>

What I try to get as a result is a table like:

element name                          items
--------------------------------------------------------------------------------
element one        |                 1
                   |                 2
                   |                 3
--------------------------------------------------------------------------------
element two        |                 4
                   |                 9
--------------------------------------------------------------------------------

Where items is a multi value field.
I tried using spath this gives me a list of the elements, but I cant get the items to be grouped by the element name.
Any help is welcome 🙂

0 Karma
Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...