Dashboards & Visualizations

how to exctract fields from nested named XML elements

swe
Path Finder

hi there,
i have xml files which are indexed with KV_MODE=xml. i want to stats on the values on datagroup name="mem-used-percent"

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<myobjects-sensor-data ms-duration="3244">
    <ident>0820958kjshf8</ident>
    <timeTimeDate>2017-04-30 23:55:15</timeTimeDate>
    <csp>true</csp>
    <sensors>
        <sensor name="mem-data" status="INFO" duration-ms="2">
            <sensorData>
                <datagroup name="mem-used-percent">
                    <probe>
                        <key>value</key>
                        <value>25.4</value>
                    </probe>
                </datagroup>
            </sensorData>
        </sensor>
        <sensor name="anotherone" status="INFO" duration-ms="2">
            <sensorData>
........
            </sensorData>
        </sensor>
    </sensors>
</myobjects-sensor-data>

the sensor data gets recognized in preview for example:
myobjects-sensor-data.sensors.sensor.sensorData.datagroup.probe.value = 25.4

but as there are multiple *probe.value i dont know how to exactly adress this value by the name of the "datagroup".

...| spath output=memdaten path="myobjects-sensor-data.sensors.sensor{@name="mem-data"}.datagroup{@name="mem-used-percent"}.probe.value"

wont work.

what am i doing wrong?

thanks
swe

Tags (1)
0 Karma
1 Solution

swe
Path Finder

hi there,

one possible solution is a combination of KV_MODE=xml, rex and mvzip. for example:

eval sensorstatuses=mvzip('myobject-sensor-data.sensors.sensor{@name}','myobject-sensor-data.sensors.sensor{@status}') 
| rex "<key>gps-latitude<\/key>\s*<value>(?<gps_latitude>.*)<\/value>"

its not nice, but works for now until someone comes up with a better solution
thanks
swe

View solution in original post

0 Karma

swe
Path Finder

hi there,

one possible solution is a combination of KV_MODE=xml, rex and mvzip. for example:

eval sensorstatuses=mvzip('myobject-sensor-data.sensors.sensor{@name}','myobject-sensor-data.sensors.sensor{@status}') 
| rex "<key>gps-latitude<\/key>\s*<value>(?<gps_latitude>.*)<\/value>"

its not nice, but works for now until someone comes up with a better solution
thanks
swe

0 Karma

swe
Path Finder

HI,

shouldnt it be possible with xpath? i tried but this did not work. any suggestions?

xpath "//myobject-sensor-data/sensors/sensor[@name='mem-data']/datagroup[@name='mem-used-percent']/probe/value" outfield=myfield

0 Karma

niketn
Legend

Instead of name it will be based on number if you are using spath

| spath output=memdaten path="myobjects-sensor-data.sensors.sensor{1}.datagroup.probe.value"

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath#6:_Extract_a_subset_of_a_XM...

If you have already defined KV_MODE=xml in your sourcetype, you can table all the required field names as separate columns and then perform search/filter

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

swe
Path Finder

thanks, adressing with a number works but if the structure changes this would not be realy reliable. so i wonder if there is a better solution.

if using table i get a massive ammount of multivalue fields, in which i cant identifiy to which keys the values belong..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...