How to extract XML attribute names and corresponding values using spath?

[premdutt]

Hi
Could you please help me on the below request?

I would like to extract fields like RETURNMESSAGE, ORIGINALFILENAME , STATE and their corresponding values. The search below did not give me any result.

| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name}

[vganjare]

Hi,

What sourcetype did you use? I used the "log4net_xml" as sourcetype and used above query. It worked fine.

| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name}

Gave following AttributeNames:

DIRECTION   1   100%    
ISALERT 1   100%    
ISSSL   1   100%    
SSLCYPHER   1   100%

Thanks!!

[premdutt]

Thank you Experts, i was struggling on adding the sample.
Please find the sample xml.

<TrkDescriptor>
<TrkXML VERSION="1.0"/>
<TrkObject>
<TrkAttr name="DIRECTION" val="S"/>
<TrkAttr name="SSLCYPHER" val="A"/>
<TrkAttr name="ISSSL" val="0"/>
<TrkAttr name="ISALERT" val="0"/>

</TrkObject>
</TrkDescriptor>

[fabioportes]

And how to filter results to only show the TrkAttr name when the TrkAttr val is = 0?
The output should be
ISSSL
ISALERT

Thanks!

[gregbo]

Did you ever figure this out?

[vganjare]

Can you please share the sample xml?

Thanks!

[fdi01]

can you show example or send your xml fine??
thank.

[premdutt]

Sample xml

[fdi01]

YES send it please

[ramdaspr]

@premdutt
Use the 'Code Sample' button (5th button on the textbox menu while you write a comment) to paste the xml else the code is stripped out.

[premdutt]

sample xml

[ramdaspr]

The sample seems to be missing..