
xpath
Description
Extracts the xpath value from field
and sets the outfield
attribute.
Syntax
xpath [outfield=<field>] <xpath-string> [field=<field>] [default=<string>]
Required arguments
- xpath-string
- Syntax: <string>
- Description: Specifies the XPath reference.
Optional arguments
- field
- Syntax: field=<field>
- Description: The field to find and extract the referenced
xpath
value from. - Default:
_raw
- outfield
- Syntax: outfield=<field>
- Description: The field to write, or output, the
xpath
value to. - Default:
xpath
- default
- Syntax: default=<string>
- Description: If the attribute referenced in
xpath
doesn't exist, this specifies what to write to theoutfield
. If this isn't defined, there is no default value.
Usage
The xpath
command is a distributable streaming command. See Command types.
The xpath
command supports the syntax described in the Python Standard Library 19.7.2.2. Supported XPath syntax.
Examples
1. Extract values from a single element in _raw
XML events
You want to extract values from a single element in _raw
XML events and write those values to a specific field.
The _raw
XML events look like this:
<foo> <bar nickname="spock"> </bar> </foo> <foo> <bar nickname="scotty"> </bar> </foo> <foo> <bar nickname="bones"> </bar> </foo>
Extract the nickname
values from _raw
XML events. Output those values to the name
field.
sourcetype="xml" | xpath outfield=name "//bar/@name"
2. Extract multiple values from _raw
XML events
Extract multiple values from _raw
XML events
The _raw
XML events look like this:
<DataSet xmlns=""> <identity_id>3017669</identity_id> <instrument_id>912383KM1</instrument_id> <transaction_code>SEL</transaction_code> <sname>BARC</sname> <currency_code>USA</currency_code> </DataSet> <DataSet xmlns=""> <identity_id>1037669</identity_id> <instrument_id>219383KM1</instrument_id> <transaction_code>SEL</transaction_code> <sname>TARC</sname> <currency_code>USA</currency_code> </DataSet>
Extract the values from the identity_id
element from the _raw
XML events:
... | xpath outfield=identity_id "//DataSet/identity_id"
This search returns two results: identity_id=3017669
and identity_id=1037669
.
To extract a combination of two elements, sname
with a specific value and instrument_id
, use this search:
... | xpath outfield=instrument_id "//DataSet[sname='BARC']/instrument_id"
Because you specify sname='BARC'
, this search returns one result: instrument_id=912383KM1
.
3. Testing extractions from XML
events
You can use the makeresults
command to test xpath
extractions.
You must add field=xml
to the end of your search. For example:
| makeresults | eval xml="<DataSet xmlns=\"\"> <identity_id>1037669</identity_id> <instrument_id>219383KM1</instrument_id> <transaction_code>SEL</transaction_code> <sname>TARC</sname> <currency_code>USA</currency_code> </DataSet>" | xpath outfield=identity_id "//DataSet/identity_id" field=xml
See also
extract, kvform, multikv, rex, spath, xmlkv
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the xpath command.
PREVIOUS xmlunescape |
NEXT xsDisplayConcept |
This documentation applies to the following versions of Splunk® Enterprise: 6.0, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8, 6.0.9, 6.0.10, 6.0.11, 6.0.12, 6.0.13, 6.0.14, 6.0.15, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.10, 6.4.11, 6.5.0, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 8.0.0, 8.0.1, 6.4.9, 6.5.1, 6.5.10, 6.5.1612 (Splunk Cloud only)
Comments
It appears that Splunk's xpath doesn't handle namespaces correctly? xpath can successfully extract the CallType from this:<br /><br />17<br /><br />But fails to extract anything if you try it on this:<br /><br />17
No problem Sophy, thanks for pointing me to spath - will take a look at it
Izakw, thanks! i corrected the examples. you may also want to check out the spath command for XML and JSON field extraction.
Tried on Splunk 4.3.3 , it didn't work as documented. We had to specify the outfield= before the XPath expression: <br /><br />This works: xpath outfield=identity_id "//DataSet/identity_id" <br />This doesn't work: xpath "//DataSet/identity_id" outfield=identity_id
Sorry -- my previous comment didn't appear correctly. The first example was XML with a "type" attribute. The second example was XML with a "xsi:type" attribute.