Splunk Search

How to get multiple values from xml using xpath and spath?

ritesh14
Explorer

I am trying to get multiple values from xml as shows below

I have tried xpath and spath and both shows nothing

I am looking for ResponseCode, SimpleResponseCode and nResponseCode

here is the sample xml for reference

 

 

 

 

 

| makeresults 
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
    <soapenv:Body>
        <ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
                            xmlns:ns3=\"http://randomurl.com/sample2\">
            <ResponseCode>OK</ResponseCode>
            <State>Simple</State>
            <Transactions>
                <TransactionName>CHANGED</TransactionName>
            </Transactions>
            <Transactions>
                <TransactionData>CHANGE_SIMPLE</TransactionData>
            </Transactions>
            <ServerTime>1649691711637</ServerTime>
            <SimpleResponseCode>OK</SimpleResponseCode>
            <nResponseCode>
                <nResponseCode>OK</nResponseCode>
            </nResponseCode>
            <USELESS>VALUES</USELESS>
            <MORE_USELESS>false</MORE_USELESS>
        </ns3:LogResponse>
    </soapenv:Body>
</soapenv:Envelope>" 
| xpath outfield=

 

 

 

 

 

Labels (2)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
    <soapenv:Body>
        <ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
                            xmlns:ns3=\"http://randomurl.com/sample2\">
            <ResponseCode>OK</ResponseCode>
            <State>Simple</State>
            <Transactions>
                <TransactionName>CHANGED</TransactionName>
            </Transactions>
            <Transactions>
                <TransactionData>CHANGE_SIMPLE</TransactionData>
            </Transactions>
            <ServerTime>1649691711637</ServerTime>
            <SimpleResponseCode>OK</SimpleResponseCode>
            <nResponseCode>
                <nResponseCode>OK</nResponseCode>
            </nResponseCode>
            <USELESS>VALUES</USELESS>
            <MORE_USELESS>false</MORE_USELESS>
        </ns3:LogResponse>
    </soapenv:Body>
</soapenv:Envelope>"
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.ResponseCode output=ResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.SimpleResponseCode output=SimpleResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.nResponseCode.nResponseCode output=nResponseCode

View solution in original post

0 Karma

yeahnah
Motivator

Just wanted to put add a xpath command solution that also works, simply as a future reference for users that can go with the spath command solution.

| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
    <soapenv:Body>
      <ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
                       xmlns:ns3=\"http://randomurl.com/sample2\">
        <LogResponse >
            <ResponseCode>OK</ResponseCode>
            <State>Simple</State>
            <Transactions>
                <TransactionName>CHANGED</TransactionName>
            </Transactions>
            <Transactions>
                <TransactionData>CHANGE_SIMPLE</TransactionData>
            </Transactions>
            <ServerTime>1649691711637</ServerTime>
            <SimpleResponseCode>OK</SimpleResponseCode>
            <nResponseCode>
                <nResponseCode>OK</nResponseCode>
            </nResponseCode>
            <USELESS>VALUES</USELESS>
            <MORE_USELESS>false</MORE_USELESS>
        </LogResponse>
      </ns3:LogResponse>
    </soapenv:Body>
</soapenv:Envelope>"
| eval xml=replace(_raw, "^<\?xml.+\?>[\r\n]*", "")   ``` xpath does not like ?xml encoding version and text declaration, so remove```  
| xpath field=xml outfield=ResponseCode "//*[local-name()='ResponseCode']"   ``` use *[local-name()='<value>' to ignore namespace declarations, i.e. xmlns='smomething' ]  ```
| xpath field=xml outfield=SimpleResponseCode "//*[local-name()='SimpleResponseCode']"
| xpath field=xml outfield=nResponseCode "//*[local-name()='nResponseCode']/nResponseCode"

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults 
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
    <soapenv:Body>
        <ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
                            xmlns:ns3=\"http://randomurl.com/sample2\">
            <ResponseCode>OK</ResponseCode>
            <State>Simple</State>
            <Transactions>
                <TransactionName>CHANGED</TransactionName>
            </Transactions>
            <Transactions>
                <TransactionData>CHANGE_SIMPLE</TransactionData>
            </Transactions>
            <ServerTime>1649691711637</ServerTime>
            <SimpleResponseCode>OK</SimpleResponseCode>
            <nResponseCode>
                <nResponseCode>OK</nResponseCode>
            </nResponseCode>
            <USELESS>VALUES</USELESS>
            <MORE_USELESS>false</MORE_USELESS>
        </ns3:LogResponse>
    </soapenv:Body>
</soapenv:Envelope>"
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.ResponseCode output=ResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.SimpleResponseCode output=SimpleResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.nResponseCode.nResponseCode output=nResponseCode
0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...