Documentation > Splunk > Search Reference > xpath

Search Reference

 


Introduction
Search Overview
Search Reference Overview
Search Commands and Functions
Search Command Reference
Custom Search Commands
Search in the CLI

xpath

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

xpath

Synopsis

Extracts the xpath value from field and sets the outfield attribute.

Syntax

xpath <string:xpath> [field=<field>] [outfield=<field>] [default=<string>]

Required arguments

xpath
Syntax: <string>
Description: Specify the XPath reference.

Optional arguments

field
Syntax: field=<field>
Description: The field to find and extract the referenced xpath value. Defaults to _raw.
outfield
Syntax: outfield=<field>
Description: The field to write the xpath value. Defaults to xpath.
default
Syntax: default=<string>
Description: If the attribute referenced in xpath doesn't exist, this specifies what to write to outfield. If this isn't defined, there is no default value.

Description

Sets the value of outfield to the value of the xpath applied to field.

Examples

Example 1: Extract the name value from _raw XML events, which might look like this: 

<foo>
<bar name="spock">
</bar>
</foo>
sourcetype="xml" | xpath "//bar/@name" outfield=name

Example 2: Extract the identity_id and instrument_id from the _raw XML events: 

   <DataSet xmlns="">
        <identity_id>3017669</identity_id>
        <instrument_id>912383KM1</instrument_id>
        <transaction_code>SEL</transaction_code>
        <sname>BARC</sname>
        <currency_code>USA</currency_code>
   </DataSet> 

   <DataSet xmlns="">
        <identity_id>1037669</identity_id>
        <instrument_id>219383KM1</instrument_id>
        <transaction_code>SEL</transaction_code>
        <sname>TARC</sname>
        <currency_code>USA</currency_code>
   </DataSet>
... | xpath "//DataSet/identity_id" outfield=identity_id

This search will return two results: identity_id=3017669 and identity_id=1037669.

... | xpath "//DataSet[sname=\"BARC\"]/instrument_id" outfield=instrument_id

Because you specify sname="BARC", this search will return one result: instrument_id=912383KM1.

See also

extract, kvform, multikv, rex, xmlkv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the xpath command.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1.4/SearchReference/Xpath"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!