Splunk Search

XML field extraction

anooshac
Communicator

Hi all, I have a xml file as below.

<?xml version="1.0" encoding="UTF-8"?>

<suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0">

<case name="a" time="626" classname="x">

<failure message="failed" /> </case>

<case name="b" time="427" classname="x" />

<case name="C" time="616" classname="y" />

<case name="d" time="626" classname="y">

<error message="error" /> </case>

<case name="e" time="621" classname="x" /> </suite>

 

The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this?

|spath output=cases path=suite.case{@name}| table cases

This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this - expand the empty cases to the full XML syntax, then extract the cases into separate events, then extract the attributes from each event

| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<suite name=\"abc\" timestamp=\"20.08.2021 15:47:20\" hostname=\"kkt2si\" tests=\"5\" failures=\"1\" errors=\"1\" time=\"0\">
<case name=\"a\" time=\"626\" classname=\"x\">
<failure message=\"failed\" /> </case>
<case name=\"b\" time=\"427\" classname=\"x\" />
<case name=\"C\" time=\"616\" classname=\"y\" />
<case name=\"d\" time=\"626\" classname=\"y\">
<error message=\"error\" /> </case>
<case name=\"e\" time=\"621\" classname=\"x\" /> </suite>"



| rex mode=sed max_match=0 "s/(?P<case>\<case )(?P<attr>[^\/\>]+)\/\>/\1\2><\/case>/g"
| rex max_match=0 "(?ms)(?<case>\<case .+?\<\/case\>)"
| mvexpand case
| spath input=case output=name path=case{@name}
| spath input=case output=failed path=case.failure{@message}
| spath input=case output=error path=case.error{@message}

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could try something like this - expand the empty cases to the full XML syntax, then extract the cases into separate events, then extract the attributes from each event

| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<suite name=\"abc\" timestamp=\"20.08.2021 15:47:20\" hostname=\"kkt2si\" tests=\"5\" failures=\"1\" errors=\"1\" time=\"0\">
<case name=\"a\" time=\"626\" classname=\"x\">
<failure message=\"failed\" /> </case>
<case name=\"b\" time=\"427\" classname=\"x\" />
<case name=\"C\" time=\"616\" classname=\"y\" />
<case name=\"d\" time=\"626\" classname=\"y\">
<error message=\"error\" /> </case>
<case name=\"e\" time=\"621\" classname=\"x\" /> </suite>"



| rex mode=sed max_match=0 "s/(?P<case>\<case )(?P<attr>[^\/\>]+)\/\>/\1\2><\/case>/g"
| rex max_match=0 "(?ms)(?<case>\<case .+?\<\/case\>)"
| mvexpand case
| spath input=case output=name path=case{@name}
| spath input=case output=failed path=case.failure{@message}
| spath input=case output=error path=case.error{@message}
0 Karma

anooshac
Communicator

Hi sir,

Thank you so much for the reply.. It works great..

Is there any way that i can merge error and failed into a single column called status? So that i can represent status in a single column?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval status=coalesce(failed, error)
0 Karma

anooshac
Communicator

yes.. Got it..  Thank you so much..

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...