Splunk Search

How to get fieldsummary on the xml values of request body

msrama5
Explorer

Hello, I have XML data as values of requestbody field in Splunk search below, need field summary on the break down of XML data, XML data is complex one and provided a sample of the XML data, how to get summary on the break down of XML data

index = aos environment=ps sourcetype=aos requestbody=*  | fields requestbody

requestbody xml values format
Transactions
Transaction
Order
OrderId abc1 OrderId
Order
Transaction
Transactions

0 Karma

to4kawa
Ultra Champion

Why do NOT you use Code Sample?

 index = aos environment=ps sourcetype=aos requestbody=*  
| spath input=requestbody
| fieldsummary

maybe, your sample below:

| makeresults
| eval _raw="<Transactions>
<Transaction>
<Order><OrderId>abc1</OrderId></<Order>
</Transaction>
</Transactions>"
| spath
| fields - _*
| fieldsummary
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...