Splunk Search

Multi value event merging and breaking

ramanjain1983
Path Finder

Hi there,

I am trying working out a scenario with Splunk and having a hard time on it.

I have got a XML which has the order number in it. I need to do everything at search time.

Example XPATH: //OrderNumber (the number of occurrence is one only in whole XML)
Then I am pulling out all the sub orders inside this order by using XPATH= //OrderNumber/SubOrderNumber ( this is dynamic - which means it can have more than 1 occurrences)
Then I am also looking for there statuses in the XML against the SubOrderNumber using XPATH= //OrderNumber/SubOrderNumberSTATUS ( this is dynamic - which means it can have more than 1 occurrences but it may be less or more than the sub order numbers)

Now the problem is that all these fields are pulled out quite well but they all are in single event.

Results:-


Event 1:

OrderNumber SubOrderNumber  SubOrderNumberStatus
12345        12345-1         Open
             12345-2         Closed
             12345-3        

But I want to see the output as individual events , something like this:

OrderNumber SubOrderNumber  SubOrderNumberStatus
12345        12345-1         Open
12345        12345-2         Closed
12345        12345-3         {leave it blank}

The above should be 3 different events.

I tried using the below query which works fine if all the fields have some data :-

| fields OrderNumber SubOrderNumber SubOrderNumberStatus
|eval fields=mvzip(OrderNumber,SubOrderNumber) | mvexpand fields | eval temp=split(fields,",") | eval OrderNumber_new =mvindex(temp,0)|eval SubOrderNumber_new =mvindex(temp,1)| table OrderNumber_new, SubOrderNumber_new

Can anyone please provide some pointer around it.

Thanks in advance.

Tags (2)
0 Karma

ramanjain1983
Path Finder

Easy this one!
I was unnecessarily complicating it by using mvzip.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...