Splunk Search

XML field extraction

anooshac
Communicator

Hi all, I have a xml file as below.

<?xml version="1.0" encoding="UTF-8"?>

<suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0">

<case name="a" time="626" classname="x">

<failure message="failed" /> </case>

<case name="b" time="427" classname="x" />

<case name="C" time="616" classname="y" />

<case name="d" time="626" classname="y">

<error message="error" /> </case>

<case name="e" time="621" classname="x" /> </suite>

 

The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this?

|spath output=cases path=suite.case{@name}| table cases

This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this - expand the empty cases to the full XML syntax, then extract the cases into separate events, then extract the attributes from each event

| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<suite name=\"abc\" timestamp=\"20.08.2021 15:47:20\" hostname=\"kkt2si\" tests=\"5\" failures=\"1\" errors=\"1\" time=\"0\">
<case name=\"a\" time=\"626\" classname=\"x\">
<failure message=\"failed\" /> </case>
<case name=\"b\" time=\"427\" classname=\"x\" />
<case name=\"C\" time=\"616\" classname=\"y\" />
<case name=\"d\" time=\"626\" classname=\"y\">
<error message=\"error\" /> </case>
<case name=\"e\" time=\"621\" classname=\"x\" /> </suite>"



| rex mode=sed max_match=0 "s/(?P<case>\<case )(?P<attr>[^\/\>]+)\/\>/\1\2><\/case>/g"
| rex max_match=0 "(?ms)(?<case>\<case .+?\<\/case\>)"
| mvexpand case
| spath input=case output=name path=case{@name}
| spath input=case output=failed path=case.failure{@message}
| spath input=case output=error path=case.error{@message}

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this - expand the empty cases to the full XML syntax, then extract the cases into separate events, then extract the attributes from each event

| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<suite name=\"abc\" timestamp=\"20.08.2021 15:47:20\" hostname=\"kkt2si\" tests=\"5\" failures=\"1\" errors=\"1\" time=\"0\">
<case name=\"a\" time=\"626\" classname=\"x\">
<failure message=\"failed\" /> </case>
<case name=\"b\" time=\"427\" classname=\"x\" />
<case name=\"C\" time=\"616\" classname=\"y\" />
<case name=\"d\" time=\"626\" classname=\"y\">
<error message=\"error\" /> </case>
<case name=\"e\" time=\"621\" classname=\"x\" /> </suite>"



| rex mode=sed max_match=0 "s/(?P<case>\<case )(?P<attr>[^\/\>]+)\/\>/\1\2><\/case>/g"
| rex max_match=0 "(?ms)(?<case>\<case .+?\<\/case\>)"
| mvexpand case
| spath input=case output=name path=case{@name}
| spath input=case output=failed path=case.failure{@message}
| spath input=case output=error path=case.error{@message}
0 Karma

anooshac
Communicator

Hi sir,

Thank you so much for the reply.. It works great..

Is there any way that i can merge error and failed into a single column called status? So that i can represent status in a single column?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval status=coalesce(failed, error)
0 Karma

anooshac
Communicator

yes.. Got it..  Thank you so much..

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...