Splunk Search

How to extract XML attribute names and corresponding values using spath?

premdutt
Explorer

Hi
Could you please help me on the below request?

I would like to extract fields like RETURNMESSAGE, ORIGINALFILENAME , STATE and their corresponding values. The search below did not give me any result.

| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name}

vganjare
Builder

Hi,

What sourcetype did you use? I used the "log4net_xml" as sourcetype and used above query. It worked fine.

| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name}

Gave following AttributeNames:

DIRECTION   1   100%    
ISALERT 1   100%    
ISSSL   1   100%    
SSLCYPHER   1   100%

Thanks!!

0 Karma

premdutt
Explorer

Thank you Experts, i was struggling on adding the sample.
Please find the sample xml.

<TrkDescriptor>
<TrkXML VERSION="1.0"/>
<TrkObject>
<TrkAttr name="DIRECTION" val="S"/>
<TrkAttr name="SSLCYPHER" val="A"/>
<TrkAttr name="ISSSL" val="0"/>
<TrkAttr name="ISALERT" val="0"/>

</TrkObject>
</TrkDescriptor>
0 Karma

fabioportes
Explorer

And how to filter results to only show the TrkAttr name when the TrkAttr val is = 0?
The output should be
ISSSL
ISALERT

Thanks!

0 Karma

gregbo
Communicator

Did you ever figure this out?

0 Karma

vganjare
Builder

Can you please share the sample xml?

Thanks!

0 Karma

fdi01
Motivator

can you show example or send your xml fine??
thank.

0 Karma

premdutt
Explorer

Sample xml

0 Karma

fdi01
Motivator

YES send it please

0 Karma

ramdaspr
Contributor

@premdutt
Use the 'Code Sample' button (5th button on the textbox menu while you write a comment) to paste the xml else the code is stripped out.

0 Karma

premdutt
Explorer

sample xml

0 Karma

ramdaspr
Contributor

The sample seems to be missing..

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!