I'm new to splunk and just started using it. I want to monitor xml files in a directory. I have used summary indexing.
Splunk for some reason couldn't automatically extract those fields,hence I have used spath to extract fields like region and customerName
Xml files have structure as below:
<Details>
    <Name>ABC</Name>
    <UniqueID>23872378</UniqueID>
    <Count>4</Count>
    <Location>
        <Region>Some Region</Region>
        <Country>Any Country</Country>
        <State>Any State in Country</State>     
        <City>Any City in State</City>
    </Location>     
</Details>  
<Customers>         
    <Customer Name="ABCD XYZ" Address="asdjasdjksj" Contact="2387387843" Email="someone@email.com">
        <Products>
            <Product ID="57" Name="Samsung Galaxy s6" Price="56000">
                <OS>
                    <Name>Android</Name>
                    <Version>5.0.1</Version>
                </OS>
                <InternalMemory>32GB</InternalMemory>
                <ExpandableMemory>128GB</ExpandableMemory>
            </Product>
        </Products>
        <Products>
            <Product ID="58" Name="Sony Xperia z4" Price="46000">
                <OS>
                    <Name>Android</Name>
                    <Version>5.0.1</Version>
                </OS>
                <InternalMemory>16GB</InternalMemory>
                <ExpandableMemory>64GB</ExpandableMemory>
            </Product>
        </Products> 
    </Customer>
    <Customer Name="Xyz Pqrs" Address="adsfgfgrt" Contact="2387397843" Email="someone2@email.com">
        <Products>
            <Product ID="57" Name="Samsung Galaxy s5" Price="42000">
                <OS>
                    <Name>Android</Name>
                    <Version>5.0</Version>
                </OS>
                <InternalMemory>32GB</InternalMemory>
                <ExpandableMemory>128GB</ExpandableMemory>
            </Product>
        </Products>
        <Products>
            <Product ID="58" Name="LG G3" Price="46000">
                <OS>
                    <Name>Android</Name>
                    <Version>5.0.1</Version>
                </OS>
                <InternalMemory>16GB</InternalMemory>
                <ExpandableMemory>64GB</ExpandableMemory>
            </Product>
        </Products> 
    </Customer>
</Customers>
<Customers>         
    ...
</Customers>
And so on
Splunk searches I want to achieve:
1.List of product sold(Product Name) with count  by Region
2.customer wise product purchased.
I didn't use rex, just used splunk searches.
 
					
				
		
If the extraction is ok,can you provide a sample table of all your extracted fields ?so we can easily help....
some values are coming as "other" while grouping.If i do precise search,i get correct values.Any Idea?
----Edit---
New updated query
index="indexforsamplexml" 
| spath output="productSold" path="Report.Customers.Customer.Products.Product{@Name}" 
| spath output="branchRegion" path="Report.Details.Location.Region"
| chart  count over branchRegion by productSold limit=0
Got one question.I had given sample data which mirrored by  data`s xml pattern.
Query which worked on sample xml doesnt seem to work on my data.
Also the second query is not working properly.
link contains sample xml files i used for monitoring 
   https://drive.google.com/file/d/0B09txzFBEkNgclBBWmdwWjRMa0U/view?usp=sharing
index="indexforsamplexml" 
| spath output="nameOfProductSold" path="Report.Customers.Customer.Products.Product{@Name}" 
| spath output="branchRegion" path="Report.Details.Location.Region"
|chart count over nameOfProductSold by branchRegion
first query ran somehow. 🙂
http://s27.postimg.org/smyo61moj/Untitled.png
I`ll try with second.
