spath xml parsing

[glasserd17]

I'm trying to extract the "user.name" field from the XML below (in pastebin). However, I can't seem to write an spath command that will do it. I was wondering if anyone could help me out. I'm wondering if my issue is that my tags have periods in them.

http://pastebin.com/0g83eBY8

[vincesesto]

Hey gloasserd17,

I think you are on the right track with thinking you naming conventions are the issue. I have just been looking at your xml data and it looks like splunk is getting mixed up with the period in between the tag elements, and I can only think that the best option would be to create a rex to search for the username values instead. Like the one below:

index=main sourcetype="TestXML" | head 10000 | rex "(?i)\\.name>(?P<FIELDNAME>[^<]+)" | top 50 FIELDNAME

You can then do what you want with the data. You could also extract this information through props.conf at index time.

I hope this helped.

Regards vince