Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF

xpath

Description

Extracts the xpath value from field and sets the outfield attribute.

Syntax

xpath [outfield=<field>] <xpath-string> [field=<field>] [default=<string>]

Required arguments

xpath-string
Syntax: <string>
Description: Specify the XPath reference.

Optional arguments

field
Syntax: field=<field>
Description: The field to find and extract the referenced xpath value.
Default: _raw
outfield
Syntax: outfield=<field>
Description: The field to write the xpath value.
Default: xpath
default
Syntax: default=<string>
Description: If the attribute referenced in xpath doesn't exist, this specifies what to write to outfield. If this isn't defined, there is no default value.

Examples

Example 1: Extract the name value from _raw XML events, which might look like this:

<foo>
<bar name="spock">
</bar>
</foo>

sourcetype="xml" | xpath outfield=name "//bar/@name"

Example 2: Extract the identity_id and instrument_id from the _raw XML events:

   <DataSet xmlns="">
        <identity_id>3017669</identity_id>
        <instrument_id>912383KM1</instrument_id>
        <transaction_code>SEL</transaction_code>
        <sname>BARC</sname>
        <currency_code>USA</currency_code>
   </DataSet> 

   <DataSet xmlns="">
        <identity_id>1037669</identity_id>
        <instrument_id>219383KM1</instrument_id>
        <transaction_code>SEL</transaction_code>
        <sname>TARC</sname>
        <currency_code>USA</currency_code>
   </DataSet>

... | xpath outfield=identity_id "//DataSet/identity_id"

This search will return two results: identity_id=3017669 and identity_id=1037669.

... | xpath outfield=instrument_id "//DataSet[sname=\"BARC\"]/instrument_id"

Because you specify sname="BARC", this search will return one result: instrument_id=912383KM1.

See also

extract, kvform, multikv, rex, spath, xmlkv

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the xpath command.

PREVIOUS
xmlunescape
  NEXT
xyseries

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18, 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.2.0, 6.2.1, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.1.0, 7.1.1, 7.1.2, 6.2.2, 6.2.3


Comments

Sorry -- my previous comment didn't appear correctly. The first example was XML with a "type" attribute. The second example was XML with a "xsi:type" attribute.

MatMeredith
December 8, 2014

It appears that Splunk's xpath doesn't handle namespaces correctly? xpath can successfully extract the CallType from this:<br /><br />17<br /><br />But fails to extract anything if you try it on this:<br /><br />17

MatMeredith
December 8, 2014

No problem Sophy, thanks for pointing me to spath - will take a look at it

Izakw
July 25, 2012

Izakw, thanks! i corrected the examples. you may also want to check out the spath command for XML and JSON field extraction.

Sophy, Splunker
July 24, 2012

Tried on Splunk 4.3.3 , it didn't work as documented. We had to specify the outfield= before the XPath expression: <br /><br />This works: xpath outfield=identity_id "//DataSet/identity_id" <br />This doesn't work: xpath "//DataSet/identity_id" outfield=identity_id

Izakw
July 24, 2012

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters