SPath and Aggregations

[yinon_nadav]

Hi,

I currently have a fairly complicated event format (see below 2 examples):

10/09/2012 09:49:55 126.115.88.95,< evn di="x12_S02" eid="21" ver1="3.5.3.21" pla="k" stc="Pil" uid="e508ssi"> < att key="14"> < it>77< /it>< /att>< att key="21">< it>2< /it>< /att>< att key="22">< it>x_77323F_ev_7EC457< /it>< /att>< /evn>

10/09/2012 09:49:55 126.115.88.95,< evn di="x12_S02" eid="21" ver1="3.5.3.21" pla="k" stc="Pil" uid="e508ssi">< att key="14">< it>50< /it>< /att>< att key="21">< it>2< /it>< /att>< att key="22">< it>x_77323F_ev_7EC457< /it>< /att>< /evn>

I need to extract the sum of the value for attribute key 14. for the above this is 77+50. so the result should be 127..
But i can't seem to get it right, not even the initial field value extraction:

spath evn.att{"14"}{@key}

any help is appreciated.

thanks,
Yinon

[eashwar]

Hello brother,

first you should extract the xml from the event add this line to the props.conf

EXTRACT-xml=(?i)(?P<xml>\<\sevn.+)

now you should use spath and specify the input field as xml

<your search>| spath input=xml

you can find your results in the field name {@evn}.{@att}.{@it}. you can also add path={@evn}.{@att}.{@it} to spath command

the search command you are looking for

use the below search if you did not add the EXTRACT to the props.conf

index="     " sourcetype="      "  | rex field=_raw "(?i)(?P<xml>\<\sevn.+)"  | spath input=xml | stats sum({@evn}.{@att}.{@it})

use the below search if you have added the EXTRACT to the props.conf

 index="     " sourcetype="      "    | spath input=xml | stats sum({@evn}.{@att}.{@it})  

happy splunking,
yours,
eashwar raghunathan

consider voting if it helped you, thanks...