Splunk Search

Query with xpath

ahogbin
Communicator

I am slowly progressing on a report but I am stuck on trying to extract some values from xml.

The values I am trying to get are contained within
<_0:Organisation key="INTERMEDIARY_ORG_001">
<_0:MailingAddress addressReference="INTERMEDIARY_ADDRESS_001"/>
<_0:OrganisationName>
<_0:TypeCode>CommonName</_0:TypeCode>
<_0:FullName>Text Values example 1</_0:FullName>
</_0:OrganisationName>
</_0:Organisation>
<_0:Organisation key="INSURED_ORG_001">
<_0:MailingAddress addressReference="INSURED_ADDRESS_001"/>
<_0:AustralianTaxInformation>
<_0:GSTRegistered>false</_0:GSTRegistered>
</_0:AustralianTaxInformation>
<_0:OrganisationName>
<_0:TypeCode>CommonName</_0:TypeCode>
<_0:FullName>Text value item 2</_0:FullName>
</_0:OrganisationName>
<_0:OrganisationName>
<_0:TypeCode>TradingName</_0:TypeCode>
<_0:FullName>Text value item 2</_0:FullName>
</_0:OrganisationName>
</_0:Organisation>

The values I am trying to get are Text Values example 1 and Text value item 2 (the second string appears twice but I am happy with either.

I am using xpath command

Somesearch stuff | xpath outfield=test1 "//[local-name()='Organisation' and *[local-name()='TypeCode']]/[local-name()='FullName']" | table test1

But not getting any results. I think the issue is to do with the fact that TypeCode is no unique but I am not sure how you can/could include the CommonName / TradingName as a key.

Help would greatly appreciated.

Thanks as always

Tags (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

please check this -

Somesearch stuff | xpath outfield=test1 "//[local-name()='Organisation']/*[local-name()='FullName']" | table test1

maybe, rex would do it -

Somesearch stuff | rex field=_raw "FullName\>"(?<fullnamerex>\w+[^\<])" | dedup fullnamerex | table test1
0 Karma

vasanthmss
Motivator

post the full xml.

V
0 Karma

ahogbin
Communicator

I cant I am sorry as it contains confidential information.
The section of concern is as above and the text that I am trying to extract is contained in no other section that that above.

For some reason the escaping XML is being removed.. will try to past again

<_0:Organisation key="INTERMEDIARY_ORG_001">
        <_0:MailingAddress addressReference="INTERMEDIARY_ADDRESS_001"/>
        <_0:OrganisationName>
          <_0:TypeCode>CommonName</_0:TypeCode>
          <_0:FullName>GARATY MURNANE - SME TRANSFER</_0:FullName>
        </_0:OrganisationName>
      </_0:Organisation>
      <_0:Organisation key="INSURED_ORG_001">
        <_0:MailingAddress addressReference="INSURED_ADDRESS_001"/>
        <_0:AustralianTaxInformation>
          <_0:GSTRegistered>false</_0:GSTRegistered>
        </_0:AustralianTaxInformation>
        <_0:OrganisationName>
          <_0:TypeCode>CommonName</_0:TypeCode>
          <_0:FullName>CDA Investments Pty Ltd</_0:FullName>
        </_0:OrganisationName>
        <_0:OrganisationName>
          <_0:TypeCode>TradingName</_0:TypeCode>
          <_0:FullName>CDA Investments Pty Ltd</_0:FullName>
        </_0:OrganisationName>
      </_0:Organisation>

I can use xpath with out issues to extract other sections of the xml it is just the above giving me grief as there is no unique key for each section.

Cheers

Alastair

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...