Hi,
I'm looking for a solution to extract xml out of standard logs on order to perform some xpath.
I cannot use rex as I do need to extract values having same tag names in different subtrees.
index="index" sourcetype="sourcetype" xml_2=* | xpath field=test1 "//Metadata/" | table test1
is showing no result.
How to make Splunk extract xml out of native log structure?
You should use field and outfield for xpath as given below.
<Your Base Search>
| xpath field=xml_2 outfield=test1 "//Metadata"
| table test1, xml2
Alternatively you can also try the spath command
<Your Base Search>
| spath input=xml_2 path="Metadata" output=test1
| table test1
For reference
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath
For xpath to work, the field test1 should have the xml portion, does it? Also, would be much simpler to provide suggestions if you could share some sample events.