Splunk Search

combine xml log, two search and value to field

jangid
Builder

My two xml log looks like this

<items><item><name>Registered Users</name><value>139</value></item><item><name>Registered Internet Users</name><value>0</value></item><item><name>Connected Users</name><percent>0</percent><value>60 / 500</value></item><item><name>Connected Internet Users</name><percent>0</percent><value>0 / 0</value></item></items></tec> 

Search for this

sourcetype=log_system "[SYSTEM]" "Registered Users" | head 1 | table name, value 

Search Result for this is

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0

AND another log

StatusRunningRH12R12 ReleaseR12System Date04-Dec-2000OS ReleaseLinux

search for this log

sourcetype=log_system "[SYSTEM]" "Status" | head 1 | table name, value 

Search Result for this is

name                    value
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I combine these two results and How do I want to convert these value to fields?

My result should be similar this

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I convert these value to fields?
e.g.

Registered_Users    Registered_Internet_Users   OS_Release
61                  0                            Linux

Thanks

0 Karma

stefandagerman
Path Finder

Have you tried an OR clause in your search, like so:

sourcetype=log_system "[SYSTEM]" ("Registered Users" OR "Status") | head 1 | table name, value

0 Karma

jangid
Builder

Yes, due to head only one result will display.
I want to head 1 from both search.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...