My raw data consists of xml data as below:
<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
Can someone help me get the below output?
FUND1 1600 ABCD
FUND2 1234 EFGH
I am using the below search, but this brings up the last row alone whereas I need both the rows shown above to be printed in my result:
"fundTemplateName" source="file location" | xmlkv | table fundTemplateName, quantityExpression, securityId
Please help/advise.
Hi, try this:
| stats count | fields - count
| eval raw = "<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
"
| spath input=raw
| table fundTemplateName, quantityExpression, securityId
Hi, try this:
| stats count | fields - count
| eval raw = "<fundTemplateName>FUND1</fundTemplateName><quantityExpression>1600</quantityExpression><securityId>ABCD</securityId><fundTemplateName>FUND2</fundTemplateName><quantityExpression>1234</quantityExpression><securityId>EFGH</securityId>
"
| spath input=raw
| table fundTemplateName, quantityExpression, securityId
Thank you! However, since I am monitoring a log file, I wouldn't know what my raw data would look like. In that case, what would be my input to the eval function? Apologies, I am new to splunk and still learning some of the tricks!
Sorry for not making it clear but as somesoni2 said, simply replace the first two lines with:
"fundTemplateName" source="file location"
I used the stats and eval to create a sample data to be able to test this, as I can't simulate your data source in my lab otherwise.
In summary, this is what you are looking for:
"fundTemplateName" source="file location"
| spath input=_raw
| table fundTemplateName, quantityExpression, securityId
Replace everything before spath command with your base search ( "fundTemplateName" source="file location"
)