Splunk Search

Extracting data using xpath

john
Communicator
source="D:\\SplunkLogs\\HI_IR.xml"|xmlkv|xpath "//HI_IN//IMK[TY_ID="\234\"]//RE_N" outfield=RE_N|stats values(RE_N)

This is the code what i have tried to fetch the RE_N value which associate with TY_ID=234. But it is fetching all the RE_N value in the file. I want only RE_N value which associate with the particular TY_ID=234. Please help. This the code which I have tried which is available in Splunk DOC.

xpath "//DataSet[sname=\"BARC\"]/instrument_id" outfield=instrument_id

But this is not working.
this is a model of xml code I am working with

<?xml version="1.0" encoding="ISO-8859-1" ?>
<HI_IN XMLNS="....">
   <HEADER>
      <FILE_NAME>HI_IR</FILE_NAME>

   </HEADER>
<IMK>
   <TY_ID>234</TY_ID>
   <RE_N>kly</RE_N>

</IMK>
<IMK>
   <TY_ID>360</TY_ID>
      <RE_N>klk</RE_N>

</IMK>
<IMK>
   <TY_ID>361</TY_ID>
      <RE_N>klo</RE_N>
</IMK>
</IMK>
<TY_ID>362</TY_ID>
  <RE_N>kjk</RE_N>
</IMK>

</HI_IN>
Tags (1)
0 Karma

cgadam
New Member

Try xpath outfield=RE_N "//HI_IN/IMK[TY_ID="234"]/RE_N"

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...