Splunk Search

How to extract XML out of a native log structure?

lkanzlie_2
Engager

Hi,

I'm looking for a solution to extract xml out of standard logs on order to perform some xpath.
I cannot use rex as I do need to extract values having same tag names in different subtrees.

index="index" sourcetype="sourcetype" xml_2=* | xpath field=test1 "//Metadata/" | table test1 

is showing no result.

How to make Splunk extract xml out of native log structure?

niketn
Legend

You should use field and outfield for xpath as given below.

<Your Base Search>
| xpath field=xml_2 outfield=test1 "//Metadata"
| table test1, xml2

Alternatively you can also try the spath command

<Your Base Search>
| spath input=xml_2 path="Metadata" output=test1
| table test1

For reference
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

For xpath to work, the field test1 should have the xml portion, does it? Also, would be much simpler to provide suggestions if you could share some sample events.

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...