Dashboards & Visualizations

How to extract unique values from XML data?

jcman01
Engager

I have a splunk log entry that contains XML. I need to extract all the unique values for Customer City, and show them, such as what I would do in Unix with sort|uniq.

Is this possible in splunk?

<request>
  <CustomerName>Smith</CustomerName>
  <CustomerAddress>111 Elm Street</CustomerAddress>
  <CustomerCity>Allentown</CustomerCity>
</request>
Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

| stats count | eval xml = "<request><CustomerName>Smith</CustomerName><CustomerAddress>111 Elm Street</CustomerAddress><CustomerCity>Allentown</CustomerCity></request>,<request><CustomerName>Smith</CustomerName><CustomerAddress>111 Elm Street</CustomerAddress><CustomerCity>Allentown</CustomerCity></request>,<request><CustomerName>Smith</CustomerName><CustomerAddress>111 Elm Street</CustomerAddress><CustomerCity>Not Allentown</CustomerCity></request>" | makemv xml delim="," | mvexpand xml | rename xml as _raw
| spath | dedup request.CustomerCity | table request.CustomerCity

The first block just sets up dummy data, the meat is the last three commands. spath grabs the fields from your XML, dedup does the sort|uniq part, table picks out just that column to show.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Try this:

| stats count | eval xml = "<request><CustomerName>Smith</CustomerName><CustomerAddress>111 Elm Street</CustomerAddress><CustomerCity>Allentown</CustomerCity></request>,<request><CustomerName>Smith</CustomerName><CustomerAddress>111 Elm Street</CustomerAddress><CustomerCity>Allentown</CustomerCity></request>,<request><CustomerName>Smith</CustomerName><CustomerAddress>111 Elm Street</CustomerAddress><CustomerCity>Not Allentown</CustomerCity></request>" | makemv xml delim="," | mvexpand xml | rename xml as _raw
| spath | dedup request.CustomerCity | table request.CustomerCity

The first block just sets up dummy data, the meat is the last three commands. spath grabs the fields from your XML, dedup does the sort|uniq part, table picks out just that column to show.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...