Hi,
I am novice to splunk and trying to learn explore things in it. Currently I am stuck with one problem while extracting the values from XML.
Here is the sample xml format from splunk message
2020:04:15:02:03:54.643 INFO xyz NOFMT 123456778 tomcat-http--105 10123456778 logged message:
<test> <dept id="0" value="Facilities"/> <dept id="1" value="Support"/> <dept id="2" value="IT" group="test"/></test>
I need to extract the xml message and trying to compare the values based on the dept ID.
for eg:
where id=0 and LIKE(value,"%facilities%") OR id=1 and LIKE(value,"%IT%")
Need to filter the messages based on above condition.
While, I am trying to extract the ID and values but results are getting cluttered and not showing the desired results.
Please help me in this regard.
... View more
