Why does xmlkv only select last field?

[salv1]

Hello fellow splunkers,

I'm posting here because I would gladly have help with the following query.

Let's say I have an XML like this one

<?xml version='1.0' encoding='UTF-8'?>
<rootElement>
    <group>
        <groupItemKey>item1</groupItemKey>
        <groupItemValue>0</groupItemValue>
    </group>
    <group>
        <groupItemKey>item2</groupItemKey>
        <groupItemValue>1</groupItemValue>
    </group>
    <group>
        <groupItemKey>item3</groupItemKey>
        <groupItemValue>2</groupItemValue>
    </group>
    ...
    <group>
        <groupItemKey>itemN</groupItemKey>
        <groupItemValue>3</groupItemValue>
    </group>
</rootElement>

And I want to extract in a table like this all the possible combinations I have of groupItemKey and groupItemValue

GroupItemKey	GroupItemValue
item1	0
item2	1
item3	2

I tried with the following query

| makeresults
| eval _raw="<?xml version='1.0' encoding='UTF-8'?><rootElement><group><groupItemKey>item1</groupItemKey><groupItemValue>0</groupItemValue></group><group><groupItemKey>item2</groupItemKey><groupItemValue>1</groupItemValue></group><group><groupItemKey>item3</groupItemKey><groupItemValue>2</groupItemValue></group><group><groupItemKey>itemN</groupItemKey><groupItemValue>3</groupItemValue></group></rootElement>"
| xmlkv
| table groupItemKey, groupItemValue

But seems like that only the item with groupItemKey "itemN" gets considered when outputting the results on the table, same goes with regex

Any ideas how to make it work so that splunk takes all the groupItemKey elements?

Thanks a lot!

[ITWhisperer · Accepted solution]

spath works with XML (as well as JSON)

| makeresults
| eval _raw="<?xml version='1.0' encoding='UTF-8'?><rootElement><group><groupItemKey>item1</groupItemKey><groupItemValue>0</groupItemValue></group><group><groupItemKey>item2</groupItemKey><groupItemValue>1</groupItemValue></group><group><groupItemKey>item3</groupItemKey><groupItemValue>2</groupItemValue></group><group><groupItemKey>itemN</groupItemKey><groupItemValue>3</groupItemValue></group></rootElement>"
| spath