How to set up an alert to send a certain field value based on a set of extracted values from an xml log file?

[imsiva]

Hi All,

I'm very new to Splunk. I would like to create an alert from my log file wherein i will first search for a string(log_InfoRequest) from the source file by which i will get the below LINES as a result. From this result i need to filter based on the condition. The condition is if value of the field in status tag is "X" and targetSystem tag is "target", send the value present in id tag 9999 in the same log file. I tried using xmlkv, xpath and some rex. However I'm not getting the desired output. I tried like below but in vain.

sourcetype="CommonLog" host="matrix*" source="/dir/Logging/Mylog.log" log_InfoRequest | xmlkv status=X AND xmlkv targetSystem=target 

my final output would should 9999

---- LINES---

2015/02/08 17:47:13:336,234rggq34-014B-4000-E000-4lnl45n42245,log_InfoRequest,Logging,< ? xml version="1.0" encoding="UTF-8" ? >
< lo:InfoRequestMsg xmlns:lo="http://services.com/Logging/Log" xmlns:ns0="wsdl.http://services.com/Logging/Log" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:me="wsdl.http://services.com/Logging/Log" xsi:type="me:InfoRequestMsg">
  < lo:Info >
    < InfoRequest xmlns:ns0="http://services.com/Logging/Log" xmlns:soap="http://www.w3.org/2003/05/soap-envelope" xmlns:wr="http://www.innovate.com/xmlns/multipart/wrapper/6.0.0" >
      < sourceSystem > source < /sourceSystem >
      < targetSystem > target < /targetSystem >
      < transactionName > myTransaction < /transactionName >
      < ID > 9999 < /ID >
      < status > X < /status >
    < /InfoRequest >
  < /lo:Info >

[somesoni2]

Try this

 sourcetype="CommonLog" host="matrix*" source="/dir/Logging/Mylog.log" log_InfoRequest | rex "targetSystem\s*\>(?<target>[^\<]+).*ID\s*\>(?<ID>[^\<]+).*status\s*\>(?<status>[^\<]+)" | where status="X" target="target" | table ID