Splunk Search

XML multivalue field extraction

mzorzi
Splunk Employee
Splunk Employee

My XML file looks like ( I have added spaces for formatting )

< contentOwner>


< gln>113456789< /gln>


< contentOwner>


< gln>1423456791< /gln>


< /contentOwner>


< contentOwner>


< gln>193456795


< /contentOwner>

and I want to extract a single multi event fields GLN=113456789,1423456791,193456795

How can I do that?

Tags (1)
0 Karma

MuS
Legend

Hi mzorzi

I cannot test it, but I would try to use spath with your XML like this

... | spath output=gln path=contentOwner.gln

see spath examples here http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Spath#Examples

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...