Splunk Search

combine xml log, two search and value to field

jangid
Builder

My two xml log looks like this

<items><item><name>Registered Users</name><value>139</value></item><item><name>Registered Internet Users</name><value>0</value></item><item><name>Connected Users</name><percent>0</percent><value>60 / 500</value></item><item><name>Connected Internet Users</name><percent>0</percent><value>0 / 0</value></item></items></tec> 

Search for this

sourcetype=log_system "[SYSTEM]" "Registered Users" | head 1 | table name, value 

Search Result for this is

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0

AND another log

StatusRunningRH12R12 ReleaseR12System Date04-Dec-2000OS ReleaseLinux

search for this log

sourcetype=log_system "[SYSTEM]" "Status" | head 1 | table name, value 

Search Result for this is

name                    value
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I combine these two results and How do I want to convert these value to fields?

My result should be similar this

name                            value
Registered Users                61
Registered Internet Users       0
Connected Users                 1/50
Connected Internet Users        0 / 0
Status                  Running
System Name             RH12    
Release                 R12
System Date             04-Dec-2000
OS Release              Linux

How Do I convert these value to fields?
e.g.

Registered_Users    Registered_Internet_Users   OS_Release
61                  0                            Linux

Thanks

0 Karma

stefandagerman
Path Finder

Have you tried an OR clause in your search, like so:

sourcetype=log_system "[SYSTEM]" ("Registered Users" OR "Status") | head 1 | table name, value

0 Karma

jangid
Builder

Yes, due to head only one result will display.
I want to head 1 from both search.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...