How do I parse my XML data in a single search?

[i2sheri]

I've an xml wth below structure

<root><stats>
    <total>
        <stat pass="12" fail="12">C</stat>
        <stat pass="12" fail="12">A</stat>
    </total>
    <tag>
        <stat pass="2" fail="4">X</stat>
        <stat pass="10 fail="8">Y</stat>
    </tag>
    <more-sets/>
</stats></root>

What I need

...| table type fail pass

I can get this separately with below search (replace total with tag and so on)

base search | table root.stats.total.stat* | rename root.stats.total.stat{@*} as * 
| eval temp=mvzip('root.stats.total.stat', mvzip(fail, pass, "#"), "#")  | table temp | mvexpand temp 
| rex field=temp "(?<Total>.*)#(?<Fail>.*)#(?<Pass>.*)" | fields Total Fail Pass

Is there a way to do it in single search ?

[somesoni2 · Accepted solution]

Try something like this

your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,(mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail

[i2sheri]

Small correction, I cannot edit your answer

 your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail

[woodcock]

I do not understand your question but have you tried spath?

http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/spath

[i2sheri]

I am new to splunk, I will try and let you know

[somesoni2]

You current search is already a single search (no subsearch/append etc). Could you be more specific on what you're looking for? May be a sudo query that you expect.

[i2sheri]

I want below from total/tag( or any other tag in ) in one search query
C 12 12
A 12 12
X 4 8
Y 8 10
with out joining above queries