I am trying to group by text within a specific field. I'm essentially searching a message content field called event. Within this event field, I am searching for specific errorCodes, but I also want to group by the error codes in the result. I'm not able to do an extraction because the message content is in xml format and I can't seem to extract the specific tag. Is there any way to handle this group by ask?
I want to group the results by unique values within my XML tag. If you couldn't tell...I'm new to this so I'm very appreciative of any guidance you can offer!
You can use spath (http://docs.splunk.com/Documentation/Splunk/6.4.0/SearchReference/Spath) to extract the field from XML at search time.
or you can use kvmode in props
KV_MODE = [none|auto|multi|json|xml] * Used for search-time field extractions only. * Specifies the field/value extraction mode for the data. * Set KV_MODE to one of the following: * none: if you want no field/value extraction to take place. * auto: extracts field/value pairs separated by equal signs. * multi: invokes the multikv search command to expand a tabular event into multiple events. * xml : automatically extracts fields from XML data. * json: automatically extracts fields from JSON data. * Setting to 'none' can ensure that one or more user-created regexes are not overridden by automatic field/value extraction for a particular host, source, or source type, and also increases search performance. * Defaults to auto. * The 'xml' and 'json' modes will not extract any fields when used on data that isn't of the correct format (JSON or XML).
Thanks for the input Renjith - I tried using spath but my search results look the same as before I included it in my search. Where should my extracted values show up?
| spath output=errorCode path=cart.errorData.error.errorCode
I don't believe the KV_mode is an option for me.
<errorData correlationId="123456789" correlationType="cartItem"> <error> <errorCode>CART_ERR_111</errorCode> <description>Inventory is not available for the item 123456789.</description> <errorProperties> <errorProperty> <name>inventory</name> <value>1</value> </errorProperty> </errorProperties> </error> </errorData>
This is what I tried and I got error code as a field
|stats count|eval abc="<cart> <errorData correlationId=\"123456789\" correlationType=\"cartItem\"> <error> <errorCode>CART_ERR_111</errorCode> <description>Inventory is not available for the item 123456789.</description> <errorProperties> <errorProperty> <name>inventory</name> <value>1</value> </errorProperty> </errorProperties> </error> </errorData> </cart>"|spath input=abc output=errorCode path=cart.errorData.error.errorCode|table errorCode