XML fields and multivalues

[tjohnston2]

I am trying to search on the name field by scap-id in the following data. When I search against it Splunk returns one value for the name and throws out the rest. How do I make name a multivalued field. I have included a dataset and my props.conf and transforms.conf.

<controls scap-id='CVE-2010-1241'>
    <control internal-id='8081023'>
      <name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='8081024'>
      <name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='8091029'>
      <name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>3</passed>
        <failed>1</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='8091030'>
      <name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9081021'>
      <name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9081022'>
      <name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9091019'>
      <name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
    <control internal-id='9091020'>
      <name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1 (French)</name>
      <release-date>Tue, 13 Apr 2010</release-date>
      <statistics>
        <scanned>4</scanned>
        <passed>4</passed>
        <failed>0</failed>
        <patched>0</patched>
        <mean-patch-time-hours>NaN</mean-patch-time-hours>
      </statistics>
      <exceptions>
        <has-exception>false</has-exception>
        <use-exception>true</use-exception>
        <exempt-count>0</exempt-count>
      </exceptions>
    </control>
  </controls>

props.conf

[bigfix]
#TIME_PREFIX = <Extended_Timestamp>
#MAX_TIMESTAMP_LOOKAHEAD = 200
#MUST_BREAK_AFTER = </controls>
#BREAK_ONLY_BEFORE_DATE = false
#SHOULD_LINEMERGE = true
#LINE_BREAKER = \>\s*(?=\<control\>)
BREAK_ONLY_BEFORE = <controls\sscap-id
REPORT-bigfix = xml-bigfix

transforms.conf

[xml-bigfix]
MV_ADD = true

[mjyates]

Can you verify this works?? My transforms.conf looks like this

[xmlkv_multivalue] REGEX = <(.?)(?:\s[^>])?>([^<]*) FORMAT = $1::$2 MV_ADD = true

[xml_bigfix] REGEX = /])?/>([^\<])\<\/name

and when I search I pipe to either on the search line and get only one value per xml pair not multiples as advertised...

[tjohnston2]

Thanks I would now like a tabular report which looks like this

scap_id
name
name
name
etc...

I can't seem to figure it out. I have tried stats list(name) by scap_id, stats values(name) by scap_id. Help

[gkanapathy]

[xml-bigfix]
REGEX = /<name(?:\s[^\>]*)?/>([^\<]*)\<\/name

[Paolo_Prigione]

If you don't mind having many lines for each sscap-id: first expand the multivalued field to multiple events, then use table: "... | mvexpand name | table _time scap-id name"

[sideview]

Sounds like you want "chart count over scap_id by name"

[tjohnston2]

Thanks I would now like a tabular report which looks like this scap_id name name name etc... I can't seem to figure it out. I have tried stats list(name) by scap_id, stats values(name) by scap_id. Help