Splunk Search

XML field extraction with spath

4uramana4u
Explorer

eval FunctionalRef=spath(_raw,"n2:EvtMsg.Bd.BOEvt.Evt.DatElGrp{2}.DatEl.Val") -> I am getting two(2) values DHL5466256965140262WH3, DE4608089.  

Instead I should get only DHL5466256965140262WH3.  So this value is not static

XML Snippet:

<DatElGrp Cd="CommonGrp">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>

Labels (1)
Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath DatElGrp.DatEl.Cd{1}
| spath DatElGrp.DatEl.Val{1}

View solution in original post

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath DatElGrp.DatEl.Cd{1}
| spath DatElGrp.DatEl.Val{1}

4uramana4u
Explorer

Excellent! Thank you so much!

Tags (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath
| rename DatElGrp{@Cd} as GrpCd, DatElGrp.* as *
| foreach DatEl.* [ eval <<FIELD>> = mvindex('<<FIELD>>' , 0)]
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...