Splunk Search

XML field Extraction

anooshac
Communicator

Hi all, I have a xml file as below.

<?xml version="1.0" encoding="UTF-8"?>

<suite name="abc" timestamp="20.08.2021 15:47:20" hostname="kkt2si" tests="5" failures="1" errors="1" time="0">

<case name="a" time="626" classname="x">

<failure message="failed" /> </case>

<case name="b" time="427" classname="x" />

<case name="C" time="616" classname="y" />

<case name="d" time="626" classname="y">

<error message="error" /> </case>

<case name="e" time="621" classname="x" /> </suite>

 

The cases which doesnt have failure or errors are the ones which are passed. I am able to make a list of cases but i am confused how to add a column of the status. Anyone know the solution for this?

|spath output=cases path=suite.case{@name}| table cases

This is how i extracted the cases. I want to add a column which shows the status. Please suggest some answers.

 

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...