Extract multiple field values from XML in Splunk

[shangshin]

Hi,
Please advise the splunk search to extract multiple field values from the xml in splunk.
For example, how can I get both the user name and user id using the sample xml below.

<users>
  <user>
    <user_name>John Jobs</user_name>
   <user_id>JJobs</user_id>
   <user_iemail>[email protected]</user_email>
</user>
 <user>
    <user_name>Mary Ann</user_name>
   <user_id>mann</user_id>
   <user_iemail>[email protected]</user_email>
 </user>
</users>

[sdaniels]

You can use the spath command to get the values that you want. See the xml examples towards the bottom.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Spath

You can also have Splunk extract all fields automatically for you:

http://splunk-base.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs

[sdaniels]

Maybe you can update the XML to show what you are talking about. Right now it's hard to tell why it's not working for you.

[shangshin]

Thank you! This is very helpful.

I am able to extract most of the elements except for the element value with forward slash.

E.g.
the xml element below users.usr.url returns an empty value.
/en-GB/app/search/flashtimeline?q=search sourcetype

Is there a special function for this?