In one log line, I have multiple xml events
example :
logtime bla bal bla
How can I display them in a table view like ?
eventid1 value1 value2
eventid2 value1 value2
eventid3 value1 value2
How can I make a count :
count all event (all ids)
?
I can only make changes on the webmanager, I have no access to the server directly...
There is a command that can help you. It shall be called "Xpath"! Along with xpath is xmlkv.
main_search_for_xml | xpath outfield=event_id "//event/@id"|xmlkv| other_stuff
Then your "other_stuff" can be your stats commands.
stats dc(event_id) as "NumberOfDistinctEventIDs" count(event_id) as "NumberOfEvents"
and
stats values(event) by event_id
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xmlkv
There is a command that can help you. It shall be called "Xpath"! Along with xpath is xmlkv.
main_search_for_xml | xpath outfield=event_id "//event/@id"|xmlkv| other_stuff
Then your "other_stuff" can be your stats commands.
stats dc(event_id) as "NumberOfDistinctEventIDs" count(event_id) as "NumberOfEvents"
and
stats values(event) by event_id
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xpath
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Xmlkv