I am new to Splunk and have been messing with this for about a week so I am looking to the community to help. I pretty much have multiple xml errors that I am trying to extract the error code "VOSCM0000I", the severity "Info" and the message "Transaction successful" out of multiple lines over a duration. Top offender over a period of time.
Any thoughts?
<ResponseMessage>
<mes:StatusCode>1</mes:StatusCode>
<mes:BusinessMessage>
<mes:Code>VOSCM0000I</mes:Code>
<mes:Severity>Info</mes:Severity>
<mes:LocalizedMessage>Transaction successful</mes:LocalizedMessage>
</mes:BusinessMessage>
<mes:BusinessMessage>
<mes:Code>RENTAL003067</mes:Code>
<mes:Severity>Error</mes:Severity>
<mes:FieldName>ValidateTicketInput.ticket</mes:FieldName>
<mes:LocalizedMessage>Total renter charge amount for this ticket obtained from pricing and payment is not matching.</mes:LocalizedMessage>
</mes:BusinessMessage>
</ResponseMessage>
I like Martin's solution, but I would finish it differently. Either should work, though.
yoursearchhere
| spath output=msg path=ResponseMessage.mes:BusinessMessage
| mvexpand msg
| rex "(?m)mes\:Code\>(?<Code>.*?)\<.*?mes\:Severity\>(?<Severity>.*?)\<.*?mes\:LocalizedMessage\>(?<Message>.*?)\<"
| top Code Severity Message
I like Martin's solution, but I would finish it differently. Either should work, though.
yoursearchhere
| spath output=msg path=ResponseMessage.mes:BusinessMessage
| mvexpand msg
| rex "(?m)mes\:Code\>(?<Code>.*?)\<.*?mes\:Severity\>(?<Severity>.*?)\<.*?mes\:LocalizedMessage\>(?<Message>.*?)\<"
| top Code Severity Message
Good point - I wasn't thinking about the fact that XML is order-independent for subelements.
An upside to the spath way is that it ignores different orderings and allows for optional elements without mucking up the regular expression - if for instance there were events with no localized message the expression would not match at all.
For the extraction spath is your friend:
... | spath output=msg path=ResponseMessage.mes:BusinessMessage | mvexpand msg | spath input=msg output=Code path=mes:Code | and so on