Splunk Search

Extract and addition of values from an XML log file

a523504
Engager

Hi, I have been trying to extract valuesd from an XMl log file but failing so far.

2
3
4

This is the string I was using:
Source = 'Sheep' | xmlkv count NumberOfSheep

Could anyone please offer me some help,
thanks for your help.

Tags (1)
0 Karma
1 Solution

emechler_splunk
Splunk Employee
Splunk Employee

Your XML is malformed; the closing tags should be </numberofsheep> as such:

<numberofsheep>2</numberofsheep>
<numberofsheep>3</numberofsheep>
<numberofsheep>4</numberofsheep>

Once you have that, you can use the xmlkv command (or the new spath command) to extract the field:

source = 'Sheep' | xmlkv

...and then use stats to sum up the values:

source = 'Sheep' | xmlkv | stats sum(numberofsheep)

View solution in original post

0 Karma

emechler_splunk
Splunk Employee
Splunk Employee

Your XML is malformed; the closing tags should be </numberofsheep> as such:

<numberofsheep>2</numberofsheep>
<numberofsheep>3</numberofsheep>
<numberofsheep>4</numberofsheep>

Once you have that, you can use the xmlkv command (or the new spath command) to extract the field:

source = 'Sheep' | xmlkv

...and then use stats to sum up the values:

source = 'Sheep' | xmlkv | stats sum(numberofsheep)

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!