Using wildcards in spath

[ashleyherbert]

Hi Guys,

I've been playing around with the spath command in 4.3.1, and am just wondering if there's any way of using wildcards in the datapath.

I'm trying to extract from an xml sourcetype which has a few slightly different structures. Basically the opening xml tag differs, as per the examples below:

Event 1

<con event="collection" id="166" timestamp="Mar 12 21:05:54 2012" intervalms="15264386.594">
  <time exclusiveaccessms="0.200" />
  <nursery freebytes="10576440" totalbytes="120795648" percent="8" />
  <tenured freebytes="70816" totalbytes="1476395008" percent="0" >
    <soa freebytes="70816" totalbytes="1476395008" percent="0" />
    <loa freebytes="0" totalbytes="0" percent="0" />
  </tenured>
</con>

Event 2

<af type="nursery" id="7510" timestamp="Mar 12 20:44:08 2012" intervalms="45242.481">
  <minimum requested_bytes="655672" />
  <time exclusiveaccessms="0.269" />
  <nursery freebytes="545568" totalbytes="120795648" percent="0" />
  <tenured freebytes="0" totalbytes="1476395008" percent="0" >
    <soa freebytes="0" totalbytes="1476395008" percent="0" />
    <loa freebytes="0" totalbytes="0" percent="0" />
  </tenured>
</af>

When extracting the 'tenured freebytes', I can use the following command:

... | spath path=con.tenured{@freebytes} output=tenured_freebytes

But as you can see, this will only work for the first event. I'd like to be able to replace the 'con' with a wildcard.

Does anybody know if this is possible?

Thanks,

Ash

[Ricapar]

Funny how these things work - I ended up on this page while looking for the exact same thing you asked. Even the same log file!

I didn't find any solution using spath, but xpath does have support for wildcards in the search.

This seemed to work for me:

| xpath "//*/tenured/@freebytes" outfield=tenured_freebytes

[ashleyherbert]

Yeah I've actually already got dashboards using xpath for these logs, but the reason I was trying to use spath is because the performance of it is a hell of a lot faster. I currently use summary indexing with a heap of xpath commands to summarise the data, but the spath command would have made it possible to get rid of the summary indexing.