Splunk Search
Highlighted

How to extract XML attribute names and corresponding values using spath?

Explorer

Hi
Could you please help me on the below request?

I would like to extract fields like RETURNMESSAGE, ORIGINALFILENAME , STATE and their corresponding values. The search below did not give me any result.

| spath output=AttributeName path=TrkDescriptor.TrkObject.TrkAttr{@name}
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Explorer

sample xml

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Contributor

The sample seems to be missing..

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Builder

Can you please share the sample xml?

Thanks!

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Motivator

can you show example or send your xml fine??
thank.

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Explorer

Sample xml

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Contributor

@premdutt
Use the 'Code Sample' button (5th button on the textbox menu while you write a comment) to paste the xml else the code is stripped out.

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Motivator

YES send it please

0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Explorer

Thank you Experts, i was struggling on adding the sample.
Please find the sample xml.

<TrkDescriptor>
<TrkXML VERSION="1.0"/>
<TrkObject>
<TrkAttr name="DIRECTION" val="S"/>
<TrkAttr name="SSLCYPHER" val="A"/>
<TrkAttr name="ISSSL" val="0"/>
<TrkAttr name="ISALERT" val="0"/>

</TrkObject>
</TrkDescriptor>
0 Karma
Highlighted

Re: How to extract XML attribute names and corresponding values using spath?

Explorer

And how to filter results to only show the TrkAttr name when the TrkAttr val is = 0?
The output should be
ISSSL
ISALERT

Thanks!

0 Karma