I want to build a multi value field from my XML. Checking out both the documentation and the answers I figure out I should use spath
instead of xmlkv
. However, the provided examples did not work for my case. So let me share what I did in order to allow you to point where is my mistake or a better new option, please.
Here is an example of my XML:
And here is the search I tried:
... | spath output=parameterNumber path=Request.RequestParameter.parameterNumber | spath output=parameterValue path=Request.RequestParameter.parameterValue
Thanks in advance!
Regards,
Tiago
Have you tried regex? Like this
... | rex max_match=0 field=fieldwithxmldata "Number\>(?<nbr>\d+).*[\n\r]*.*.*\>(?<val>\w+)" | eval z=mvzip(nbr, val) | mvexpand z | rex field=z "(?<nbr>[^,]+),(?<val>.*)"
Have you tried regex? Like this
... | rex max_match=0 field=fieldwithxmldata "Number\>(?<nbr>\d+).*[\n\r]*.*.*\>(?<val>\w+)" | eval z=mvzip(nbr, val) | mvexpand z | rex field=z "(?<nbr>[^,]+),(?<val>.*)"
Worked, thank you! 🙂
Just complementing, I think I can't set KV_MODE = xml
in my props.conf as sugested in * https://answers.splunk.com/answers/227887/how-to-extract-multivalue-fields-from-xml-data-at.html * because the events are not XML-formated, but the XML is into one particular field in some events.
I also tryed the following and did not work...
... | xmlkv | table ID, TS, Name, Request.RequestParameter.parameterNumber, Request.RequestParameter.parameterValue
😞