Hi,
I currently have a fairly complicated event format (see below 2 examples):
10/09/2012 09:49:55 126.115.88.95,< evn di="x12_S02" eid="21" ver1="3.5.3.21" pla="k" stc="Pil" uid="e508ssi"> < att key="14"> < it>77< /it>< /att>< att key="21">< it>2< /it>< /att>< att key="22">< it>x_77323F_ev_7EC457< /it>< /att>< /evn>
10/09/2012 09:49:55 126.115.88.95,< evn di="x12_S02" eid="21" ver1="3.5.3.21" pla="k" stc="Pil" uid="e508ssi">< att key="14">< it>50< /it>< /att>< att key="21">< it>2< /it>< /att>< att key="22">< it>x_77323F_ev_7EC457< /it>< /att>< /evn>
I need to extract the sum of the value for attribute key 14. for the above this is 77+50. so the result should be 127..
But i can't seem to get it right, not even the initial field value extraction:
spath evn.att{"14"}{@key}
any help is appreciated.
thanks,
Yinon
... View more