- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
i have xml file like this, how can i table it with xpath or spath?
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<error-codes>
<error-code code="000" message="Exceeded" severity="1" InfoCode="0000" action="" description=""/>
<error-code code="001" message="Not Found" severity="1" InfoCode="0000" action="" description=" nope"/>
</error-codes>
</info>
excpected output:
.... | table code message severity InfoCode action description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Firstly split error-codes into separate events, then extract all the field attributes, then create new fields based on the attribute name
| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>
<info xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\">
<error-codes>
<error-code code=\"000\" message=\"Exceeded\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\"\"/>
<error-code code=\"001\" message=\"Not Found\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\" nope\"/>
</error-codes>
</info>"
| spath path="info.error-codes" output=errorcodes
| eval _raw=errorcodes
| multikv noheader=t
| table _raw
| spath
| foreach "error-code{@*}"
[| eval _name="<<MATCHSEG1>>"
| eval {_name}='<<FIELD>>']
| rename error-code* as _error-code*
| table code message severity InfoCode action description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Firstly split error-codes into separate events, then extract all the field attributes, then create new fields based on the attribute name
| makeresults
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>
<info xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\">
<error-codes>
<error-code code=\"000\" message=\"Exceeded\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\"\"/>
<error-code code=\"001\" message=\"Not Found\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\" nope\"/>
</error-codes>
</info>"
| spath path="info.error-codes" output=errorcodes
| eval _raw=errorcodes
| multikv noheader=t
| table _raw
| spath
| foreach "error-code{@*}"
[| eval _name="<<MATCHSEG1>>"
| eval {_name}='<<FIELD>>']
| rename error-code* as _error-code*
| table code message severity InfoCode action description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ITWhisperer Thank you for answer
i can see it successfuly extract fields from xml file, when i run this spl ....| table _raw
but no result when I run this ....| table code message severity InfoCode action description
here is the full spl
index="my-index" source="/home/file.xml"
| spath path="info.error-codes" output=errorcodes
| eval _raw=errorcodes
| multikv noheader=t
| table _raw
| spath
| foreach "error-code{@*}"
[| eval _name="<<MATCHSEG1>>"
| eval {_name}='<<FIELD>>']
| rename error-code* as _error-code*
| table code message severity InfoCode action description
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You haven't got a closing double quote around your index name?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when i copy here accidentally removed, corect spl have double quotes.
I modify last reply.
any other idea?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

What do you get without the last table line?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
after some workaround it work,I try to remove file and add with custom source type. finally table return result.
Thanks,
