How to create multiple subevents out of a field ?

[sbsbb]

In one log line, I have multiple xml events
example :
logtime bla bal bla

• How can I display them in a table view like ?
  eventid1 value1 value2
  eventid2 value1 value2
  eventid3 value1 value2

• How can I make a count :
  count all event (all ids)
  ?

I can only make changes on the webmanager, I have no access to the server directly...

[alacercogitatus · Accepted solution]

There is a command that can help you. It shall be called "Xpath"! Along with xpath is xmlkv.

main_search_for_xml | xpath outfield=event_id "//event/@id"|xmlkv| other_stuff

Then your "other_stuff" can be your stats commands.

stats dc(event_id) as "NumberOfDistinctEventIDs" count(event_id) as "NumberOfEvents"

and

stats values(event) by event_id

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xmlkv