I've an xml wth below structure
<root><stats>
<total>
<stat pass="12" fail="12">C</stat>
<stat pass="12" fail="12">A</stat>
</total>
<tag>
<stat pass="2" fail="4">X</stat>
<stat pass="10 fail="8">Y</stat>
</tag>
<more-sets/>
</stats></root>
What I need
...| table type fail pass
I can get this separately with below search (replace total with tag and so on)
base search | table root.stats.total.stat* | rename root.stats.total.stat{@*} as *
| eval temp=mvzip('root.stats.total.stat', mvzip(fail, pass, "#"), "#") | table temp | mvexpand temp
| rex field=temp "(?<Total>.*)#(?<Fail>.*)#(?<Pass>.*)" | fields Total Fail Pass
Is there a way to do it in single search ?
Try something like this
your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,(mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail
Try something like this
your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,(mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail
Small correction, I cannot edit your answer
your base search | rex max_match=0 "\<stat pass=\"(?<Pass>\d+)\" fail=\"(?<Fail>\d+)\"\>(?<Metrics>[^\<]+)\<\/stat\>" | eval temp=mvzip(Metrics,mvzip(Pass,Fail,"#"),"#") | table temp | mvexpand temp | rex field=temp "(?<Metrics>.*)#(?<Pass>.*)#(?<Fail>.*)" | table Metrics Pass Fail
I do not understand your question but have you tried spath
?
http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/spath
I am new to splunk, I will try and let you know
You current search is already a single search (no subsearch/append etc). Could you be more specific on what you're looking for? May be a sudo query that you expect.
I want below from total/tag( or any other tag in ) in one search query
C 12 12
A 12 12
X 4 8
Y 8 10
with out joining above queries