XML field extraction

[anooshac]

Hi all, I have a xml file as below.

<?xml version="1.0" encoding="UTF-8"?>

<suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0">

<case name="a" time="626" classname="x">

<failure message="failed" /> </case>

<case name="b" time="427" classname="x" />

<case name="C" time="616" classname="y" />

<case name="d" time="626" classname="y">

<error message="error" /> </case>

<case name="e" time="621" classname="x" /> </suite>

The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this?

|spath output=cases path=suite.case{@name}| table cases

This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

[ITWhisperer · Accepted solution]

You could try something like this - expand the empty cases to the full XML syntax, then extract the cases into separate events, then extract the attributes from each event

| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<suite name=\"abc\" timestamp=\"20.08.2021 15:47:20\" hostname=\"kkt2si\" tests=\"5\" failures=\"1\" errors=\"1\" time=\"0\">
<case name=\"a\" time=\"626\" classname=\"x\">
<failure message=\"failed\" /> </case>
<case name=\"b\" time=\"427\" classname=\"x\" />
<case name=\"C\" time=\"616\" classname=\"y\" />
<case name=\"d\" time=\"626\" classname=\"y\">
<error message=\"error\" /> </case>
<case name=\"e\" time=\"621\" classname=\"x\" /> </suite>"



| rex mode=sed max_match=0 "s/(?P<case>\<case )(?P<attr>[^\/\>]+)\/\>/\1\2><\/case>/g"
| rex max_match=0 "(?ms)(?<case>\<case .+?\<\/case\>)"
| mvexpand case
| spath input=case output=name path=case{@name}
| spath input=case output=failed path=case.failure{@message}
| spath input=case output=error path=case.error{@message}

[anooshac]

Hi sir,

Thank you so much for the reply.. It works great..

Is there any way that i can merge error and failed into a single column called status? So that i can represent status in a single column?

[ITWhisperer]

| eval status=coalesce(failed, error)

[anooshac]

yes.. Got it..  Thank you so much..