Splunk Search

spath vs xpath parse xml

indeed_2000
Motivator

Hi

i have xml file like this, how can i table it with xpath or spath?

 

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<info xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<error-codes>
<error-code code="000" message="Exceeded" severity="1" InfoCode="0000" action="" description=""/>
<error-code code="001" message="Not Found" severity="1" InfoCode="0000" action="" description=" nope"/>
</error-codes>

</info>

 

 

excpected output:

....  | table code message severity InfoCode  action description

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Firstly split error-codes into separate events, then extract all the field attributes, then create new fields based on the attribute name

| makeresults 
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>
<info xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\">
<error-codes>
<error-code code=\"000\" message=\"Exceeded\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\"\"/>
<error-code code=\"001\" message=\"Not Found\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\" nope\"/>
</error-codes>

</info>"



| spath path="info.error-codes" output=errorcodes
| eval _raw=errorcodes
| multikv noheader=t
| table _raw
| spath
| foreach "error-code{@*}"
    [| eval _name="<<MATCHSEG1>>"
    | eval {_name}='<<FIELD>>']
| rename error-code* as _error-code*
| table code message severity InfoCode  action description

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Firstly split error-codes into separate events, then extract all the field attributes, then create new fields based on the attribute name

| makeresults 
| eval _raw="<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?>
<info xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\">
<error-codes>
<error-code code=\"000\" message=\"Exceeded\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\"\"/>
<error-code code=\"001\" message=\"Not Found\" severity=\"1\" InfoCode=\"0000\" action=\"\" description=\" nope\"/>
</error-codes>

</info>"



| spath path="info.error-codes" output=errorcodes
| eval _raw=errorcodes
| multikv noheader=t
| table _raw
| spath
| foreach "error-code{@*}"
    [| eval _name="<<MATCHSEG1>>"
    | eval {_name}='<<FIELD>>']
| rename error-code* as _error-code*
| table code message severity InfoCode  action description

indeed_2000
Motivator

@ITWhisperer Thank you for answer

i can see it successfuly extract fields from xml file, when i run this spl  ....| table _raw

but no result when I run this   ....|  table code message severity InfoCode action description

here is the full spl

 

 

 

index="my-index" source="/home/file.xml"
| spath path="info.error-codes" output=errorcodes
| eval _raw=errorcodes
| multikv noheader=t
| table _raw
| spath
| foreach "error-code{@*}"
    [| eval _name="<<MATCHSEG1>>"
    | eval {_name}='<<FIELD>>']
| rename error-code* as _error-code*
| table code message severity InfoCode  action description

 

 

 

any idea?
Thanks
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You haven't got a closing double quote around your index name?

0 Karma

indeed_2000
Motivator

when i copy here accidentally removed, corect spl have double quotes.

I modify last reply.

any other idea?

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you get without the last table line?

0 Karma

indeed_2000
Motivator

after some workaround it work,I try to remove file and add with custom source type. finally table return result.

Thanks,

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...