Splunk Search

XML field extraction with spath

4uramana4u
Explorer

eval FunctionalRef=spath(_raw,"n2:EvtMsg.Bd.BOEvt.Evt.DatElGrp{2}.DatEl.Val") -> I am getting two(2) values DHL5466256965140262WH3, DE4608089.  

Instead I should get only DHL5466256965140262WH3.  So this value is not static

XML Snippet:

<DatElGrp Cd="CommonGrp">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>

Labels (1)
Tags (2)
0 Karma
1 Solution

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath DatElGrp.DatEl.Cd{1}
| spath DatElGrp.DatEl.Val{1}

View solution in original post

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath DatElGrp.DatEl.Cd{1}
| spath DatElGrp.DatEl.Val{1}

4uramana4u
Explorer

Excellent! Thank you so much!

Tags (1)
0 Karma

to4kawa
Ultra Champion
index=_internal | head 1 | fields _raw
| eval _raw="<DatElGrp Cd=\"CommonGrp\">
<DatEl>
<Cd>FunctionalRef</Cd>
<Val>DHL5466256965140262WH3</Val>
</DatEl>
<DatEl>
<Cd>DeclarantID</Cd>
<Val>DE4608089</Val>
</DatEl>
</DatElGrp>"
| spath
| rename DatElGrp{@Cd} as GrpCd, DatElGrp.* as *
| foreach DatEl.* [ eval <<FIELD>> = mvindex('<<FIELD>>' , 0)]
0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...