Getting Data In

XML parsing with condition

indianhans
Engager

Hi

I am novice to splunk and need help in writing a splunk query in order to find Order ID (ORD********)


Sample XML


0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I can't see your sample data.

0 Karma

fdi01
Motivator

run in bar search the following search:
index=your_index_name

or
index=your_index_name source=your_source_name sourcetype=your_sourcetype_name

index=your_index_name source=your_source_name sourcetype=your_sourcetype_name|....your_condictions_search
exple:
index=you_index host=you_host "Error" | chart count sparkline(count, 1h) as trend by host | sort -count

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is this even related to the question?

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...