I not found further variants and has committed fixes to the script splunk/etc/apps/search/bin/xpath.py
original script
...
et = etree.parse(StringIO.StringIO(myxml))
nodes = et.xpath(path)
values = [tostr(node) for node in nodes]
result[outfield] = values
...
fixed script
...
et = etree.parse(StringIO.StringIO(myxml))
nodes = et.xpath(path)
if isinstance(nodes, str):
values = nodes
else:
values = [tostr(node) for node in nodes]
result[outfield] = values
...
After that the query started returns correct result
I hope developers will solve the problem in a future releases
... View more