- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ritesh14
Explorer
04-15-2022
09:15 AM
I am trying to get multiple values from xml as shows below
I have tried xpath and spath and both shows nothing
I am looking for ResponseCode, SimpleResponseCode and nResponseCode
here is the sample xml for reference
| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
<soapenv:Body>
<ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
xmlns:ns3=\"http://randomurl.com/sample2\">
<ResponseCode>OK</ResponseCode>
<State>Simple</State>
<Transactions>
<TransactionName>CHANGED</TransactionName>
</Transactions>
<Transactions>
<TransactionData>CHANGE_SIMPLE</TransactionData>
</Transactions>
<ServerTime>1649691711637</ServerTime>
<SimpleResponseCode>OK</SimpleResponseCode>
<nResponseCode>
<nResponseCode>OK</nResponseCode>
</nResponseCode>
<USELESS>VALUES</USELESS>
<MORE_USELESS>false</MORE_USELESS>
</ns3:LogResponse>
</soapenv:Body>
</soapenv:Envelope>"
| xpath outfield=
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
04-15-2022
09:58 AM
| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
<soapenv:Body>
<ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
xmlns:ns3=\"http://randomurl.com/sample2\">
<ResponseCode>OK</ResponseCode>
<State>Simple</State>
<Transactions>
<TransactionName>CHANGED</TransactionName>
</Transactions>
<Transactions>
<TransactionData>CHANGE_SIMPLE</TransactionData>
</Transactions>
<ServerTime>1649691711637</ServerTime>
<SimpleResponseCode>OK</SimpleResponseCode>
<nResponseCode>
<nResponseCode>OK</nResponseCode>
</nResponseCode>
<USELESS>VALUES</USELESS>
<MORE_USELESS>false</MORE_USELESS>
</ns3:LogResponse>
</soapenv:Body>
</soapenv:Envelope>"
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.ResponseCode output=ResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.SimpleResponseCode output=SimpleResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.nResponseCode.nResponseCode output=nResponseCode
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yeahnah
Motivator
02-09-2025
08:40 PM
Just wanted to put add a xpath command solution that also works, simply as a future reference for users that can go with the spath command solution.
| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
<soapenv:Body>
<ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
xmlns:ns3=\"http://randomurl.com/sample2\">
<LogResponse >
<ResponseCode>OK</ResponseCode>
<State>Simple</State>
<Transactions>
<TransactionName>CHANGED</TransactionName>
</Transactions>
<Transactions>
<TransactionData>CHANGE_SIMPLE</TransactionData>
</Transactions>
<ServerTime>1649691711637</ServerTime>
<SimpleResponseCode>OK</SimpleResponseCode>
<nResponseCode>
<nResponseCode>OK</nResponseCode>
</nResponseCode>
<USELESS>VALUES</USELESS>
<MORE_USELESS>false</MORE_USELESS>
</LogResponse>
</ns3:LogResponse>
</soapenv:Body>
</soapenv:Envelope>"
| eval xml=replace(_raw, "^<\?xml.+\?>[\r\n]*", "") ``` xpath does not like ?xml encoding version and text declaration, so remove```
| xpath field=xml outfield=ResponseCode "//*[local-name()='ResponseCode']" ``` use *[local-name()='<value>' to ignore namespace declarations, i.e. xmlns='smomething' ] ```
| xpath field=xml outfield=SimpleResponseCode "//*[local-name()='SimpleResponseCode']"
| xpath field=xml outfield=nResponseCode "//*[local-name()='nResponseCode']/nResponseCode"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
04-15-2022
09:58 AM
| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"utf-8\"?>
<soapenv:Envelope xmlns:soapenv=\"http://schemas.xmlsoap.org/soap/envelope/\">
<soapenv:Body>
<ns3:LogResponse xmlns:ns2=\"http://randomurl.com/sample1\"
xmlns:ns3=\"http://randomurl.com/sample2\">
<ResponseCode>OK</ResponseCode>
<State>Simple</State>
<Transactions>
<TransactionName>CHANGED</TransactionName>
</Transactions>
<Transactions>
<TransactionData>CHANGE_SIMPLE</TransactionData>
</Transactions>
<ServerTime>1649691711637</ServerTime>
<SimpleResponseCode>OK</SimpleResponseCode>
<nResponseCode>
<nResponseCode>OK</nResponseCode>
</nResponseCode>
<USELESS>VALUES</USELESS>
<MORE_USELESS>false</MORE_USELESS>
</ns3:LogResponse>
</soapenv:Body>
</soapenv:Envelope>"
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.ResponseCode output=ResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.SimpleResponseCode output=SimpleResponseCode
| spath soapenv:Envelope.soapenv:Body.ns3:LogResponse.nResponseCode.nResponseCode output=nResponseCode
