Splunk Search

How to get fieldsummary on the xml values of request body

msrama5
Explorer

Hello, I have XML data as values of requestbody field in Splunk search below, need field summary on the break down of XML data, XML data is complex one and provided a sample of the XML data, how to get summary on the break down of XML data

index = aos environment=ps sourcetype=aos requestbody=*  | fields requestbody

requestbody xml values format
Transactions
Transaction
Order
OrderId abc1 OrderId
Order
Transaction
Transactions

0 Karma

to4kawa
Ultra Champion

Why do NOT you use Code Sample?

 index = aos environment=ps sourcetype=aos requestbody=*  
| spath input=requestbody
| fieldsummary

maybe, your sample below:

| makeresults
| eval _raw="<Transactions>
<Transaction>
<Order><OrderId>abc1</OrderId></<Order>
</Transaction>
</Transactions>"
| spath
| fields - _*
| fieldsummary
0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...