XML: Extract field and assign to multiple events

[a1352019]

I'm attempting to read in an XML file in the following format:

<a> data </a>
<q> other data </q>
   <b> item </b>
      <i> item data </i>
      <p> more item data </p>
   <b> another item </b>
      <i> item data </i>
      <p> more item data </p>
   <b> yet another item </b>
      <i> item data </i>
      <p> more item data </p>

I've managed to modify the props.conf to split the xml and read in each 'b' item (and it's children) as a separate event.

What I'm stuck on is extracting the data held within the 'a' and 'q' tags and assigning that to every event that is received below it.

Is this possible?

[gelica]

Did you solve this? 🙂

[Ayn]

Perhaps you could use filldown for this? http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Filldown