Getting Data In

XML parsing with condition

indianhans
Engager

Hi

I am novice to splunk and need help in writing a splunk query in order to find Order ID (ORD********)


Sample XML


0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I can't see your sample data.

0 Karma

fdi01
Motivator

run in bar search the following search:
index=your_index_name

or
index=your_index_name source=your_source_name sourcetype=your_sourcetype_name

index=your_index_name source=your_source_name sourcetype=your_sourcetype_name|....your_condictions_search
exple:
index=you_index host=you_host "Error" | chart count sparkline(count, 1h) as trend by host | sort -count

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Is this even related to the question?

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...