Splunk Search

combine xml log, two search and value to field

jangid
Builder

My two xml log looks like this

<items><item><name>Registered Users</name><value>139</value></item><item><name>Registered Internet Users</name><value>0</value></item><item><name>Connected Users</name><percent>0</percent><value>60 / 500</value></item><item><name>Connected Internet Users</name><percent>0</percent><value>0 / 0</value></item></items></tec> 

Search for this

sourcetype=log_system "[SYSTEM]" "Registered Users" | head 1 | table name, value 

Search Result for this is

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0

AND another log

StatusRunningRH12R12 ReleaseR12System Date04-Dec-2000OS ReleaseLinux

search for this log

sourcetype=log_system "[SYSTEM]" "Status" | head 1 | table name, value 

Search Result for this is

name                    value
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I combine these two results and How do I want to convert these value to fields?

My result should be similar this

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I convert these value to fields?
e.g.

Registered_Users    Registered_Internet_Users   OS_Release
61                  0                            Linux

Thanks

0 Karma

stefandagerman
Path Finder

Have you tried an OR clause in your search, like so:

sourcetype=log_system "[SYSTEM]" ("Registered Users" OR "Status") | head 1 | table name, value

0 Karma

jangid
Builder

Yes, due to head only one result will display.
I want to head 1 from both search.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...