How to extract XML out of a native log structure?

[lkanzlie_2]

Hi,

I'm looking for a solution to extract xml out of standard logs on order to perform some xpath.
I cannot use rex as I do need to extract values having same tag names in different subtrees.

index="index" sourcetype="sourcetype" xml_2=* | xpath field=test1 "//Metadata/" | table test1 

is showing no result.

How to make Splunk extract xml out of native log structure?

[niketn]

You should use field and outfield for xpath as given below.

<Your Base Search>
| xpath field=xml_2 outfield=test1 "//Metadata"
| table test1, xml2

Alternatively you can also try the spath command

<Your Base Search>
| spath input=xml_2 path="Metadata" output=test1
| table test1

For reference
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

[somesoni2]

For xpath to work, the field test1 should have the xml portion, does it? Also, would be much simpler to provide suggestions if you could share some sample events.