Activity Feed
- Got Karma for Re: Possible bug when using mvzip with xpath extracted fields. 06-13-2023 06:38 AM
- Posted Re: Possible bug when using mvzip with xpath extracted fields on Splunk Search. 06-12-2023 02:19 AM
- Karma Re: Possible bug when using mvzip with xpath extracted fields for ITWhisperer. 06-11-2023 11:32 AM
- Posted Re: Possible bug when using mvzip with xpath extracted fields on Splunk Search. 06-11-2023 11:31 AM
- Posted Can anyone confirm possible bug when using mvzip with xpath extracted fields? on Splunk Search. 06-11-2023 08:53 AM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 |
06-12-2023
02:19 AM
1 Karma
Sure, I'd be happy to. Could you please guide me on how to do that?
... View more
06-11-2023
11:31 AM
Thank you! I have tried using spath before and it indeed does the job for simple extractions. However, I was trying to get the xpath approach to work because my real data is deeply nested with repeating node elements and I require complex xPath expressions to extract the fields of interest. Oh well, at least I know I wasn't going crazy! Hopefully Splunk will fix this in a coming release.
... View more
06-11-2023
08:53 AM
Hello Splunk experts,
I am encountering strange behaviour when using mvzip on fields extracted using xpath commands.
I have provided a toy dataset below that mimics my XML events. I expect mvzip to combine the values in nickname and title pairwise. However, the search below creates only one pair and that too with the "wrong" set of values; the second value from nickname is combined with the first value from title. The other pair is not combined at all.
| makeresults
| eval _raw="<foo><bar nickname=\"spock\" title=\"commander\"></bar></foo><foo><bar nickname=\"scotty\" title=\"engineer\"></bar></foo>"
| xpath outfield=nickname "//foo/bar/@nickname" field=_raw
| xpath outfield=title "//foo/bar/@title" field=_raw
| eval zipped=mvzip(nickname, title, "|")
When I use the same syntax on fields extracted via regular expressions, the output is correct. So, I'm suspecting that mvzip doesn't play nice with multivalue fields extracted using xpath.
Can anyone confirm if this is a bug or if I'm doing something wrong? I am running Splunk 8.1.3 in case anyone knows if this has been addressed in a later release.
... View more
Labels
- Labels:
-
Other