Splunk Search

XML field Extraction

anooshac
Communicator

Hi all, I have a xml file as below.

<?xml version="1.0" encoding="UTF-8"?>

<suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0">

<case name="a" time="626" classname="x">

<failure message="failed" /> </case>

<case name="b" time="427" classname="x" />

<case name="C" time="616" classname="y" />

<case name="d" time="626" classname="y">

<error message="error" /> </case>

<case name="e" time="621" classname="x" /> </suite>

 

The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this?

|spath output=cases path=suite.case{@name}| table cases

This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

 

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...