Hi Splunk Experts,
I've different XML request(100+ requests) as a multi-line event. Is it possible to stat these requests and get their count. But all these request would have any values between their tags and rex-ing all these request to stat them would be a difficult task, but is there any possible way to achieve this criteria. Any suggestion would be very much helpful!!. Thanks in advance!!
You can use spath to extract fields from XML (as well as JSON).
Perhaps if you could share some anonymised events, we might be able to advise you better.
Hi @ITWhisperer!! Thanks for the assistance.
The Request 1 & Request 3 shares the same template, but the value passed in the tags are different, but I want to consider these two request as same, while using a stat command and expecting it to return count as '2' for request with books & genres as '1'
Request 1:
<?xml version="1.0"?>
<catalog>
<book id="bk101">
<author>Gambardella, Matthew</author>
<title>XML Developer's Guide</title>
<genre>Computer</genre>
<price>44.95</price>
<publish_date>2000-10-01</publish_date>
<description>An in-depth look at creating applications
with XML.</description>
</book>
</catalog>
Request 2:
<?xml version="1.0"?>
<catalog>
<genres code="gc101">
<genre>Romance</genre>
<genre>Horror</genre>
<genre>Science Fiction</genre>
</genres>
</catalog>
Request 3:
<?xml version="1.0"?>
<catalog>
<book id="bk111">
<author>O'Brien, Tim</author>
<title>MSXML3: A Comprehensive Guide</title>
<genre>Computer</genre>
<price>36.95</price>
<publish_date>2000-12-01</publish_date>
<description>The Microsoft MSXML3 parser is covered in
detail, with attention to XML DOM interfaces, XSLT processing,
SAX and more.</description>
</book>
</catalog>
If you just want to count the first level keys within catalog, you could do this
| rex "<catalog>\s+<(?<key>\w+)"
| stats count by key
There are no such differentiates, just to make clear on requirement I shared the sample xml request. The only difference we can identify is based on complete template.
I am not sure I understand what you mean - here is a runanywhere example showing the extraction of the first level key from catalog and the stats count
| makeresults
| eval _raw="<?xml version=\"1.0\"?>
<catalog>
<book id=\"bk101\">
<author>Gambardella, Matthew</author>
<title>XML Developer's Guide</title>
<genre>Computer</genre>
<price>44.95</price>
<publish_date>2000-10-01</publish_date>
<description>An in-depth look at creating applications
with XML.</description>
</book>
</catalog>|<?xml version=\"1.0\"?>
<catalog>
<genres code=\"gc101\">
<genre>Romance</genre>
<genre>Horror</genre>
<genre>Science Fiction</genre>
</genres>
</catalog>|<?xml version=\"1.0\"?>
<catalog>
<book id=\"bk111\">
<author>O'Brien, Tim</author>
<title>MSXML3: A Comprehensive Guide</title>
<genre>Computer</genre>
<price>36.95</price>
<publish_date>2000-12-01</publish_date>
<description>The Microsoft MSXML3 parser is covered in
detail, with attention to XML DOM interfaces, XSLT processing,
SAX and more.</description>
</book>
</catalog>"
| eval xml=split(_raw,"|")
| mvexpand xml
| table xml
| rex field=xml "<catalog>\s+<(?<key>\w+)"
| stats count by key