I'm trying to extract the "user.name" field from the XML below (in pastebin). However, I can't seem to write an spath command that will do it. I was wondering if anyone could help me out. I'm wondering if my issue is that my tags have periods in them.
Hey gloasserd17,
I think you are on the right track with thinking you naming conventions are the issue. I have just been looking at your xml data and it looks like splunk is getting mixed up with the period in between the tag elements, and I can only think that the best option would be to create a rex to search for the username values instead. Like the one below:
index=main sourcetype="TestXML" | head 10000 | rex "(?i)\\.name>(?P<FIELDNAME>[^<]+)" | top 50 FIELDNAME
You can then do what you want with the data. You could also extract this information through props.conf at index time.
I hope this helped.
Regards vince