Getting Data In

XML parsing with condition

indianhans
Engager

Hi

I am novice to splunk and need help in writing a splunk query in order to find Order ID (ORD********)


Sample XML


0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I can't see your sample data.

0 Karma

fdi01
Motivator

run in bar search the following search:
index=your_index_name

or
index=your_index_name source=your_source_name sourcetype=your_sourcetype_name

index=your_index_name source=your_source_name sourcetype=your_sourcetype_name|....your_condictions_search
exple:
index=you_index host=you_host "Error" | chart count sparkline(count, 1h) as trend by host | sort -count

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is this even related to the question?

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...