Splunk Search

Extracting data using xpath

john
Communicator
source="D:\\SplunkLogs\\HI_IR.xml"|xmlkv|xpath "//HI_IN//IMK[TY_ID="\234\"]//RE_N" outfield=RE_N|stats values(RE_N)

This is the code what i have tried to fetch the RE_N value which associate with TY_ID=234. But it is fetching all the RE_N value in the file. I want only RE_N value which associate with the particular TY_ID=234. Please help. This the code which I have tried which is available in Splunk DOC.

xpath "//DataSet[sname=\"BARC\"]/instrument_id" outfield=instrument_id

But this is not working.
this is a model of xml code I am working with

<?xml version="1.0" encoding="ISO-8859-1" ?>
<HI_IN XMLNS="....">
   <HEADER>
      <FILE_NAME>HI_IR</FILE_NAME>

   </HEADER>
<IMK>
   <TY_ID>234</TY_ID>
   <RE_N>kly</RE_N>

</IMK>
<IMK>
   <TY_ID>360</TY_ID>
      <RE_N>klk</RE_N>

</IMK>
<IMK>
   <TY_ID>361</TY_ID>
      <RE_N>klo</RE_N>
</IMK>
</IMK>
<TY_ID>362</TY_ID>
  <RE_N>kjk</RE_N>
</IMK>

</HI_IN>
Tags (1)
0 Karma

cgadam
New Member

Try xpath outfield=RE_N "//HI_IN/IMK[TY_ID="234"]/RE_N"

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...