Splunk Search

How to get fieldsummary on the xml values of request body

msrama5
Explorer

Hello, I have XML data as values of requestbody field in Splunk search below, need field summary on the break down of XML data, XML data is complex one and provided a sample of the XML data, how to get summary on the break down of XML data

index = aos environment=ps sourcetype=aos requestbody=*  | fields requestbody

requestbody xml values format
Transactions
Transaction
Order
OrderId abc1 OrderId
Order
Transaction
Transactions

0 Karma

to4kawa
Ultra Champion

Why do NOT you use Code Sample?

 index = aos environment=ps sourcetype=aos requestbody=*  
| spath input=requestbody
| fieldsummary

maybe, your sample below:

| makeresults
| eval _raw="<Transactions>
<Transaction>
<Order><OrderId>abc1</OrderId></<Order>
</Transaction>
</Transactions>"
| spath
| fields - _*
| fieldsummary
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...