Splunk Search

XML field extraction with spath

4uramana4u
Explorer

eval FunctionalRef=spath(_raw,"n2:EvtMsg.Bd.BOEvt.Evt.DatElGrp{2}.DatEl.Val") -> I am getting two(2) values DHL5466256965140262WH3, DE4608089.  

Instead I should get only DHL5466256965140262WH3.  So this value is not static

XML Snippet:

<DatElGrp Cd="CommonGrp">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>

Labels (1)
Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath DatElGrp.DatEl.Cd{1}
| spath DatElGrp.DatEl.Val{1}

View solution in original post

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath DatElGrp.DatEl.Cd{1}
| spath DatElGrp.DatEl.Val{1}

4uramana4u
Explorer

Excellent! Thank you so much!

Tags (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath
| rename DatElGrp{@Cd} as GrpCd, DatElGrp.* as *
| foreach DatEl.* [ eval <<FIELD>> = mvindex('<<FIELD>>' , 0)]
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...