Splunk Search

SPath and Aggregations

New Member

Hi,

I currently have a fairly complicated event format (see below 2 examples):

10/09/2012 09:49:55 126.115.88.95,< evn di="x12_S02" eid="21" ver1="3.5.3.21" pla="k" stc="Pil" uid="e508ssi"> < att key="14"> < it>77< /it>< /att>< att key="21">< it>2< /it>< /att>< att key="22">< it>x_77323F_ev_7EC457< /it>< /att>< /evn>

10/09/2012 09:49:55 126.115.88.95,< evn di="x12_S02" eid="21" ver1="3.5.3.21" pla="k" stc="Pil" uid="e508ssi">< att key="14">< it>50< /it>< /att>< att key="21">< it>2< /it>< /att>< att key="22">< it>x_77323F_ev_7EC457< /it>< /att>< /evn>

I need to extract the sum of the value for attribute key 14. for the above this is 77+50. so the result should be 127..
But i can't seem to get it right, not even the initial field value extraction:

spath evn.att{"14"}{@key}

any help is appreciated.

thanks,
Yinon

Tags (1)
0 Karma

Communicator

Hello brother,

first you should extract the xml from the event add this line to the props.conf

EXTRACT-xml=(?i)(?P<xml>\<\sevn.+)

now you should use spath and specify the input field as xml

<your search>| spath input=xml

you can find your results in the field name {@evn}.{@att}.{@it}. you can also add path={@evn}.{@att}.{@it} to spath command

the search command you are looking for

use the below search if you did not add the EXTRACT to the props.conf

index="     " sourcetype="      "  | rex field=_raw "(?i)(?P<xml>\<\sevn.+)"  | spath input=xml | stats sum({@evn}.{@att}.{@it})

use the below search if you have added the EXTRACT to the props.conf

 index="     " sourcetype="      "    | spath input=xml | stats sum({@evn}.{@att}.{@it})  

happy splunking,
yours,
eashwar raghunathan

consider voting if it helped you, thanks...

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!