Splunk Search

How to show multiple values for a single field in splunk

vikramphilar
New Member

My raw data consists of xml data as below:

<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>

Can someone help me get the below output?

FUND1 1600 ABCD
FUND2 1234 EFGH

I am using the below search, but this brings up the last row alone whereas I need both the rows shown above to be printed in my result:

"fundTemplateName" source="file location" | xmlkv | table fundTemplateName, quantityExpression, securityId

Please help/advise.

Tags (3)
0 Karma
1 Solution

javiergn
Super Champion

Hi, try this:

| stats count | fields - count
| eval raw = "<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
"
| spath input=raw
| table fundTemplateName, quantityExpression, securityId

View solution in original post

0 Karma

javiergn
Super Champion

Hi, try this:

| stats count | fields - count
| eval raw = "<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
"
| spath input=raw
| table fundTemplateName, quantityExpression, securityId
0 Karma

vikramphilar
New Member

Thank you! However, since I am monitoring a log file, I wouldn't know what my raw data would look like. In that case, what would be my input to the eval function? Apologies, I am new to splunk and still learning some of the tricks!

0 Karma

javiergn
Super Champion

Sorry for not making it clear but as somesoni2 said, simply replace the first two lines with:

"fundTemplateName" source="file location"

I used the stats and eval to create a sample data to be able to test this, as I can't simulate your data source in my lab otherwise.

In summary, this is what you are looking for:

"fundTemplateName" source="file location"
| spath input=_raw
| table fundTemplateName, quantityExpression, securityId
0 Karma

somesoni2
Revered Legend

Replace everything before spath command with your base search ( "fundTemplateName" source="file location" )

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...