XML Field Extraction -- Multiple Lines

[ksimpkins]

I am new to Splunk and have been messing with this for about a week so I am looking to the community to help. I pretty much have multiple xml errors that I am trying to extract the error code "VOSCM0000I", the severity "Info" and the message "Transaction successful" out of multiple lines over a duration. Top offender over a period of time.

Any thoughts?

 <ResponseMessage>
    <mes:StatusCode>1</mes:StatusCode>
    <mes:BusinessMessage>
      <mes:Code>VOSCM0000I</mes:Code>
      <mes:Severity>Info</mes:Severity>
      <mes:LocalizedMessage>Transaction successful</mes:LocalizedMessage>
    </mes:BusinessMessage>
    <mes:BusinessMessage>
      <mes:Code>RENTAL003067</mes:Code>
      <mes:Severity>Error</mes:Severity>
      <mes:FieldName>ValidateTicketInput.ticket</mes:FieldName>
      <mes:LocalizedMessage>Total renter charge amount for this ticket obtained from pricing and payment is not matching.</mes:LocalizedMessage>
    </mes:BusinessMessage>
  </ResponseMessage>

[lguinn2 · Accepted solution]

I like Martin's solution, but I would finish it differently. Either should work, though.

yoursearchhere
| spath output=msg path=ResponseMessage.mes:BusinessMessage 
| mvexpand msg
| rex "(?m)mes\:Code\>(?<Code>.*?)\<.*?mes\:Severity\>(?<Severity>.*?)\<.*?mes\:LocalizedMessage\>(?<Message>.*?)\<"
| top Code Severity Message

[lguinn2]

Good point - I wasn't thinking about the fact that XML is order-independent for subelements.

[martin_mueller]

An upside to the spath way is that it ignores different orderings and allows for optional elements without mucking up the regular expression - if for instance there were events with no localized message the expression would not match at all.

[martin_mueller]

For the extraction spath is your friend:

...  | spath output=msg path=ResponseMessage.mes:BusinessMessage | mvexpand msg | spath input=msg output=Code path=mes:Code | and so on