Splunk Search

How to show multiple values for a single field in splunk

vikramphilar
New Member

My raw data consists of xml data as below:

<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>

Can someone help me get the below output?

FUND1 1600 ABCD
FUND2 1234 EFGH

I am using the below search, but this brings up the last row alone whereas I need both the rows shown above to be printed in my result:

"fundTemplateName" source="file location" | xmlkv | table fundTemplateName, quantityExpression, securityId

Please help/advise.

Tags (3)
0 Karma
1 Solution

javiergn
Super Champion

Hi, try this:

| stats count | fields - count
| eval raw = "<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
"
| spath input=raw
| table fundTemplateName, quantityExpression, securityId

View solution in original post

0 Karma

javiergn
Super Champion

Hi, try this:

| stats count | fields - count
| eval raw = "<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
"
| spath input=raw
| table fundTemplateName, quantityExpression, securityId
0 Karma

vikramphilar
New Member

Thank you! However, since I am monitoring a log file, I wouldn't know what my raw data would look like. In that case, what would be my input to the eval function? Apologies, I am new to splunk and still learning some of the tricks!

0 Karma

javiergn
Super Champion

Sorry for not making it clear but as somesoni2 said, simply replace the first two lines with:

"fundTemplateName" source="file location"

I used the stats and eval to create a sample data to be able to test this, as I can't simulate your data source in my lab otherwise.

In summary, this is what you are looking for:

"fundTemplateName" source="file location"
| spath input=_raw
| table fundTemplateName, quantityExpression, securityId
0 Karma

somesoni2
Revered Legend

Replace everything before spath command with your base search ( "fundTemplateName" source="file location" )

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...