Splunk Search

Aligning Multivalue field from XML nodes with multiple attributes

RedHeron
Engager

Hi, I'm trying to create a table as below:

methodlatlon
blue35781144960035
red  
green  
yellow35781134960032


I tried using split  but I don't get the correct order as shown below. 

methodlatlon
blue
red
green
yellow
3578113
3578114
4960032
4960035


An excerpt of the the xml is below  and I'm able to extract the correct  order if I use xpath but sometimes the xml source file has  extra data at the end which prevent xpath from reading the data.  

Is there a way to read the "method" elements  below besides using xpath such as 

| xpath outfield=lat_blue "//response_data/position_data/PositioningMethodAndUsage[@method='blue']/position_estimate/pointWithAltitudeAndUncertaintyEllipsoid/geographicalCoordinates/lat"

I want to bullet proof this in case the xml file is broken.

<file>
<reference_id>12345678</reference_id>
<session_id>1256555</session_id>
<positioning_request_time utc_off="-0800">19800228082202</positioning_request_time>
<network type="iden"></network>
<response_data type="Success">
<position_data>
<PositioningMethodAndUsage method="blue" locationReturn="NO">
<positionresultCode>99</positionresultCode>
<timeStamp utc_off="-0800">20220228082203</timeStamp>
</PositioningMethodAndUsage>
<PositioningMethodAndUsage method="red" locationReturn="NO">
<positionresultCode>99</positionresultCode>
<timeStamp utc_off="-0800">20220228082203</timeStamp>
</PositioningMethodAndUsage>
<PositioningMethodAndUsage method="green" sourceOfAltitude="3D" locationReturn="YES">
<positionresultCode>1</positionresultCode>
<position_estimate>
<pointWithAltitudeAndUncertaintyEllipsoid>
<geographicalCoordinates>
<latSign type="North"></latSign>
<lat>3878113</lat>
<lon>-4360032</lon>
</geographicalCoordinates>
<altitudeAndDirection>
<directionOfAltitude>height</directionOfAltitude>
<altitude>232</altitude>
</altitudeAndDirection>
</pointWithAltitudeAndUncertaintyEllipsoid>
</position_estimate>
</PositioningMethodAndUsage>
<PositioningMethodAndUsage method="yellow" locationReturn="NO">
<positionresultCode>1</positionresultCode>
<position_estimate>
<pointWithAltitudeAndUncertaintyEllipsoid>
<geographicalCoordinates>
<latSign type="North"></latSign>
<lat>3878114</lat>
<lon>-4360035</lon>

</PositioningMethodAndUsage>

</response_data>
</file>



Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try extracting each element with rex and then mvexpand

| rex max_match=0 "(?ms)(?<positiondata>\<PositioningMethodAndUsage.+?\</PositioningMethodAndUsage\>)"
| mvexpand positiondata

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try extracting each element with rex and then mvexpand

| rex max_match=0 "(?ms)(?<positiondata>\<PositioningMethodAndUsage.+?\</PositioningMethodAndUsage\>)"
| mvexpand positiondata
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...