Splunk Search

How to create multiple subevents out of a field ?

sbsbb
Builder

In one log line, I have multiple xml events
example :
logtime bla bal bla

  • How can I display them in a table view like ?
    eventid1 value1 value2
    eventid2 value1 value2
    eventid3 value1 value2

  • How can I make a count :
    count all event (all ids)
    ?

I can only make changes on the webmanager, I have no access to the server directly...

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

There is a command that can help you. It shall be called "Xpath"! Along with xpath is xmlkv.

main_search_for_xml | xpath outfield=event_id "//event/@id"|xmlkv| other_stuff

Then your "other_stuff" can be your stats commands.

stats dc(event_id) as "NumberOfDistinctEventIDs" count(event_id) as "NumberOfEvents"

and

stats values(event) by event_id

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xmlkv

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

There is a command that can help you. It shall be called "Xpath"! Along with xpath is xmlkv.

main_search_for_xml | xpath outfield=event_id "//event/@id"|xmlkv| other_stuff

Then your "other_stuff" can be your stats commands.

stats dc(event_id) as "NumberOfDistinctEventIDs" count(event_id) as "NumberOfEvents"

and

stats values(event) by event_id

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xmlkv

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...