Here is a sample section of the XML Data I am attempting to sum:
<Product>
<ProductItem>1</ProductItem>
<ProdCode>SampleProductCode</ProdCode>
<ProdPrice>400.00</ProdPrice>
</Product>
<Product>
<ProductItem>2</ProductItem>
<ProdCode>SampleProductCode</ProdCode>
<ProdPrice>400.00</ProdPrice>
</Product>
When I use xmlkv | stats sum(ProdPrice) as Total the value returned is 400.00 and not 800.00. There can be n number of Product sections in a single XML event record.
@Tom_Oliveri, will the xml have single product (same product by product code) repeated multiple times or can one xml data have multiple products (codes)? What is the root xml node or which node/s wraps <Product>
node?
Please try the following after providing your base search and xml path to the Product node.
<yourBaseSearch>
| spath
| rename "<yourXMLPathForProductNode>.Product.*" as "*"
| eval data=mvzip(ProdCode,ProdPrice)
| fields - _raw _time ProdCode ProdPrice ProductItem
| mvexpand data
| eval data=split(data,",")
| eval ProdCode=mvindex(data,0), ProdPrice=mvindex(data,1)
| fields - data
| stats sum(ProdPrice) as Total by ProdCode
I would like to list each ProductPrice by Product Item.
ProdItem|ProdPrice
1|400.00
2|400.00
Spath and xmllv seem to only pull the last value for the field
I would like to list each ProductPrice by Product Item.
ProdItem|ProdPrice
1|400.00
2|400.00
Spath and xmllv seem to only pull the last value for the field