The value based filter is not supported in Splunk's spath. (see the spath documentation for supported functionalities). Something like this would work for your requirement (run anywhere example, first few lines are just to generate sample data).
| gentimes start=-1 | eval _raw="<Audit>
<tracker>XXXXX123</tracker>
<Message><?xml version="1.0" encoding="UTF-8"?><ABCxmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:qu="http://qqqq.xsd" xmlns:v1="http://www" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<RM>
<Code>111</Code>
<State>Avilable</State>
</RM>
<RM>
<Code>222</Code>
<State>Not available</State>
</RM>
<RM>
<Code>333</Code>
<State>Not sure</State>
</RM>
</ABC>
</Message>
</Audit>" | table _raw | spath | rename Audit.Message as Message | eval Message1 = replace (Message,"<","<")
| eval Message1 = replace (Message1,">",">")
| eval Message3 = replace (Message1,""","\"") | eval Message4=replace(Message3,"^([^\>]+)","") | eval Message5=replace(Message4,"^\>([^\>]+)\>","") | table Message5 | spath input=Message5 | eval temp=mvzip('RM.Code','RM.State',"#") | eval temp=mvfilter(match(temp,"#Not available"))
... View more
