I have an xml file and using spath for it. My xml is having a tag like: <messages> <name>test1</name> <message-a> <cust-id>cust-1</cust-id> <part-a>name-1</part-a> <part-b>name-2</part-b> </message-a> <message-b> <cust-id>cust-2</cust-id> <part-a>name-1</part-a> <part-b>name-2</part-b> </message-b> <messages> I want to use a if condition in both input and path fields of spath ... View more

We are having a issue. Sometimes our input XML file is splint in to two. In the above image you can see, both are same files but last 6 lines are split in to another. So when we read the file using 'spath' we are getting null value. Example file in correct format : <?xml version="1.0" encoding="UTF-8"?><message> <software-version>4.1.1810-65</software-version> <customer-job-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001</customer-job-id> <submission> <submit-number>1</submit-number> <job-submission-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001.s1</job-submission-id> <frame-inches-along-web-initial-value>10.850</frame-inches-along-web-initial-value> <frame-inches-across-web>17.000</frame-inches-across-web> <statistics> <current-copy/> <actual-linear-feet-used>3515.5</actual-linear-feet-used> <sides> <side-a> <frames-printed-ok>3844</frames-printed-ok> <frames-printed-error>0</frames-printed-error> </side-a> <side-b> <frames-printed-ok>3844</frames-printed-ok> <frames-printed-error>0</frames-printed-error> </side-b> </sides> <ink-usage> <units>liters</units> <sides> <side-a completed="true"> <fixer>0.004482</fixer> <black>0.01374</black> <cyan>0.002765</cyan> <magenta>0.007962</magenta> <yellow>0.000572</yellow> </side-a> <side-b completed="true"> <fixer>0.003547</fixer> <black>0.01467</black> <cyan>0.002751</cyan> <magenta>0.009444</magenta> <yellow>0.00047</yellow> </side-b> </sides> </ink-usage> </statistics> </submission> </message> Example file in another format : File 1: <?xml version="1.0" encoding="UTF-8"?><message> <software-version>4.1.1810-65</software-version> <customer-job-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001</customer-job-id> <submission> <submit-number>1</submit-number> <job-submission-id>722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001.s1</job-submission-id> <frame-inches-along-web-initial-value>10.850</frame-inches-along-web-initial-value> <frame-inches-across-web>17.000</frame-inches-across-web> <statistics> <current-copy/> <actual-linear-feet-used>3515.5</actual-linear-feet-used> <sides> <side-a> <frames-printed-ok>3844</frames-printed-ok> <frames-printed-error>0</frames-printed-error> </side-a> <side-b> <frames-printed-ok>3844</frames-printed-ok> <frames-printed-error>0</frames-printed-error> </side-b> </sides> <ink-usage> <units>liters</units> <sides> <side-a completed="true"> <fixer>0.004482</fixer> <black>0.01374</black> <cyan>0.002765</cyan> <magenta>0.007962</magenta> <yellow>0.000572</yellow> </side-a> <side-b completed="true"> <fixer>0.003547</fixer> <black>0.01467</black> <cyan>0.002751</cyan> <magenta>0.009444</magenta> <yellow>0.00047</yellow> File 2: </side-b> </sides> </ink-usage> </statistics> </submission> </message> Query : (index="sample_*") sourcetype=sample_job_xml |where host="XP251" | where source="apc/def/722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001" | spath input=_raw path=message.customer-job-id output=customer-job-id | spath input=_raw path=message.submission output=submission | spath input=submission path=job-submission-id output=job-submission-id | spath input=submission path=statistics.actual-linear-feet-used output=actual-linear-feet-used | spath input=submission path=frame-inches-across-web output=frame-inches-across-web | spath input=submission path=frame-inches-along-web output=frame-inches-along-web | spath input=submission path=job-manifest.end-range.side-a.copy-relative-frame-number output=side-a.copy-relative-frame-number | spath input=submission path=job-manifest.end-range.side-b.copy-relative-frame-number output=side-b.copy-relative-frame-number | spath input=submission path=statistics.sides.side-a.frames-printed-ok output=side-a.frames-printed-ok | spath input=submission path=statistics.sides.side-b.frames-printed-ok output=side-b.frames-printed-ok | spath input=submission path=statistics.ink-usage.sides.side-a.fixer output=side-a.fixer | spath input=submission path=statistics.ink-usage.sides.side-b.fixer output=side-b.fixer | spath input=submission path=statistics.ink-usage.sides.side-a.black output=sides.side-a.black | spath input=submission path=statistics.ink-usage.sides.side-b.black output=side-b.black | spath input=submission path=statistics.ink-usage.sides.side-a.cyan output=side-a.cyan | spath input=submission path=statistics.ink-usage.sides.side-b.cyan output=side-b.cyan | spath input=submission path=statistics.ink-usage.sides.side-a.magenta output=side-a.magenta | spath input=submission path=statistics.ink-usage.sides.side-b.magenta output=side-b.magenta | spath input=submission path=statistics.ink-usage.sides.side-a.yellow output=side-a.yellow | spath input=submission path=statistics.ink-usage.sides.side-b.yellow output=side-b.yellow | fields host,source,customer-job-id,job-submission-id,actual-linear-feet-used,frame-inches-across-web,frame-inches-along-web,side-a.copy-relative-frame-number,side-b.copy-relative-frame-number,side-a.frames-printed-ok,side-b.frames-printed-ok,side-a.fixer,side-b.fixer,sides.side-a.black,side-b.black,side-a.cyan,side-b.cyan,side-a.magenta,side-b.magenta,side-a.yellow,side-b.yellow |eval res=substr('customer-job-id',0,9), numberString=replace(if(like(res, "%v1_%"), mvindex(split(res,"_"),1), if(like(res, "%%"),mvindex(split(res,"-"),0),res)),"\D","") ,Jobnumber=if('customer-job-id'="startup-calibration","Diagnostic",if(len(numberString)=6,numberString,"UnKnown")) | table host,source,Jobnumber,customer-job-id,job-submission-id,actual-linear-feet-used,frame-inches-across-web,frame-inches-along-web,side-a.copy-relative-frame-number,side-b.copy-relative-frame-number,side-a.frames-printed-ok,side-b.frames-printed-ok,side-a.fixer,side-b.fixer,sides.side-a.black,side-b.black,side-a.cyan,side-b.cyan,side-a.magenta,side-b.magenta,side-a.yellow,side-b.yellow | fillnull value="NULL" | where host="XP251"  and 'customer-job-id'="722739-151801-NBS-CMC400-001-LT_Slit-Merge-NBS-001" sample result Here  in have to get the values instead of null when the file is split in to two. Thanks in advance ... View more

I have displayed two sample xml files below.  I have to check whether a xml file has <customer-job-id> and <submission> tags. If both tags are there then we have to take it otherwise leave the xml file and move to next xml file Sample XML file: <?xml version="1.0" encoding="UTF-8"?><message> <customer-job-id>cust1</customer-job-id> <submission> <job> </job> </submission></message>   <?xml version="1.0" encoding="UTF-8"?><message> <customer-job-id>cust2</customer-job-id> </message> ... View more

<?xml version="1.0" encoding="UTF-8"?><message> <software-version>4.1.1810-65</software-version> <source>pia</source> <spec-version>6</spec-version> <message-name>roll-manifest-data</message-name> <roll-summary> <output-roll-id>A00812135</output-roll-id> <input-rolls/> <group-jobs/> <jobs> <job type="diagnostic" distance-run="1583" units="inches" id="spit-page-lead-in-sfhc-hi_0xqo6"/> <job type="single" distance-run="32635" units="inches"> <job-submission-id>712537-15788-KPIC_PG-116-KPIC-00768.s1</job-submission-id> <frames> <printed-ok>29400</printed-ok> <printed-error>0</printed-error> </frames> </job> <job type="single" distance-run="326354" units="inches"> <job-submission-id>712537-15788-KPIC_PG-116-KPIC-0094.s1</job-submission-id> <frames> <printed-ok>29500</printed-ok> <printed-error>0</printed-error> </frames> </job> </jobs> </roll-summary> <jobs> <job> <customer-job-id>spit-page-lead-in-sfhc-hi</customer-job-id> <job-submission-id>spit-page-lead-in-sfhc-hi_0xqo6</job-submission-id> <job-manifest> <start-range> <sequence>0</sequence> <side-a> <universal-frame-id>spit-page-lead-in-sfhc-hi_0xqo6-copy001-frame00</universal-frame-id> <copy-number>1</copy-number> <copy-relative-frame-number>1</copy-relative-frame-number> <copy-relative-signature-number>1</copy-relative-signature-number> <side>side-a</side> <serial-number>2155475</serial-number> <printed-timestamp>2021-03-23T07:13:44.091</printed-timestamp> </side-a> <side-b> <universal-frame-id>spit-page-lead-in-sfhc-hi_0xqo6-copy001-frame</universal-frame-id> <copy-number>1</copy-number> <copy-relative-frame-number>2</copy-relative-frame-number> <copy-relative-signature-number>1</copy-relative-signature-number> <side>side-b</side> <serial-number>215548</serial-number> <printed-timestamp>2021-03-23T07:14:09.460-0700</printed-timestamp> </side-b> </start-range> <end-range> <sequence>1</sequence> <side-a> <universal-frame-id>spit-page-lead-in-sfhc-hi_0xqo6-copy001-frame</universal-frame-id> <copy-number>1</copy-number> <copy-relative-frame-number>7</copy-relative-frame-number> <copy-relative-signature-number>4</copy-relative-signature-number> <side>side-a</side> <serial-number>215553</serial-number> <printed-timestamp>2021-03-23T07:13:44.819</printed-timestamp> </side-a> <side-b> <universal-frame-id>spit-page-lead-in-sfhc-hi_0xqo6-copy-frame</universal-frame-id> <copy-number>1</copy-number> <copy-relative-frame-number>8</copy-relative-frame-number> <copy-relative-signature-number>4</copy-relative-signature-number> <side>side-b</side> <serial-number>215554</serial-number> <printed-timestamp>2021-03-23T07:14:09.888</printed-timestamp> </side-b> </end-range> <start-printing> <sequence>2</sequence> <timestamp>2021-03-23T07:13:44.228</timestamp> </start-printing> <start-printing> <sequence>3</sequence> <timestamp>2021-03-23T07:13:58.152</timestamp> </start-printing> <end-printing> <sequence>4</sequence> <timestamp>2021-03-23T07:14:09.890</timestamp> <position units="inches">1549.27834</position> </end-printing> </job-manifest> <content-metadata/> </job> </jobs> </message> Above i have given the sample data. Here i have to get the data from <jobs>. Expected output is customer-job-id serialnumber(start-range -> side-a) serialnumber(start-range -> side-b) serialnumber(end-range -> side-a) serialnumber(end-range -> side-a)           I have three scenarios: 1)Inside <jobs> some <job> will have all the data correctly (ex : first job). In that case i need the output as below customer-job-id serialnumber(start-range -> side-a) serialnumber(start-range -> side-b) serialnumber(end-range -> side-a) serialnumber(end-range -> side-a) 712537-15789-KPIC_PG-120-KPIC-001 215547 215548 215553 215554   ... View more