How compliant is the xpath command with the real xpath? Is there a specific xpath library used?
The Splunk xpath search command uses the Python lxml library http://codespeak.net/lxml/ that is packaged and shipped with the Splunk Python installation. According to its own FAQ http://codespeak.net/lxml/FAQ.html#what-standards-does-lxml-implement it uses Gnome libxml2 and libxslt. I believe these are considered among the most standards-compliant implementations available.
The search command itself is a relatively simple wrapper script that is in $SPLUNK_HOME/etc/apps/search/bin/xpath.py. It is possible to replace or add a different parser by writing a similar script around it. See: http://www.splunk.com/base/Documentation/latest/SearchReference/Aboutcustomsearchcommands
View solution in original post
Phython lib is located http://lxml.de/
Wow, great answer!