Extract and addition of values from an XML log file

[a523504]

Hi, I have been trying to extract valuesd from an XMl log file but failing so far.

2
3
4

This is the string I was using:
Source = 'Sheep' | xmlkv count NumberOfSheep

Could anyone please offer me some help,
thanks for your help.

[emechler_splunk · Accepted solution]

Your XML is malformed; the closing tags should be </numberofsheep> as such:

<numberofsheep>2</numberofsheep>
<numberofsheep>3</numberofsheep>
<numberofsheep>4</numberofsheep>

Once you have that, you can use the xmlkv command (or the new spath command) to extract the field:

source = 'Sheep' | xmlkv

...and then use stats to sum up the values:

source = 'Sheep' | xmlkv | stats sum(numberofsheep)