需要在Splunk中创建一个嵌套表或具有多个列的表

Question

我有一个有效的Splunk搜索，该搜索从日志记录语句中的xml文件中提取数据。搜索将创建一个包含14列的表。下面是创建此表的查询

<sourcetype and other data>..| xmlkv  | rex max_match=0 "\<ns2\:numberCode\>(?P<location>[^\<]+)"| eval Segment1_Origin =  mvindex(location, 7), Segment1_Destination = mvindex(location, 8), Segment2_Origin = mvindex(location, 10), Segment2_Destination = mvindex(location, 11), Segment3_Origin = mvindex(location, 13), Segment3_Destination = mvindex(location, 14)  |  rex max_match=0 "\<carrier\>(?P<carrier>[^\<]+)" | eval Segment1_Carrier =  mvindex(carrier, 0), Segment2_Carrier = mvindex(carrier, 1), Segment3_Carrier = mvindex(carrier, 2) |  rex max_match=0 "\<billingMethod\>(?P<billingMethod>[^\<]+)" | eval Segment1_BillingMethod =  mvindex(billingMethod, 0), Segment2_BillingMethod = mvindex(billingMethod, 1), Segment3_BillingMethod = mvindex(billingMethod, 2) | table purchCostReference, eventType, Segment1_Carrier, Segment1_BillingMethod, Segment1_Origin, Segment1_Destination, Segment2_Carrier, Segment2_BillingMethod, Segment2_Origin, Segment2_Destination, Segment3_Carrier, Segment3_BillingMethod, Segment3_Origin, Segment3_Destination | sort purchCostReference, eventType

该表如下所示（由于大小，未显示所有列）：

我希望表格以某种方式将表格嵌套在细分中。

或类似这样：

Splunk中的这些表设计之一吗？

Answer 1

这就是我创建表的第二个实例的方式。添加了一个时间字段。使用这些命令，我​​解析了xml

中所需的值

sourcetype... |xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments =  mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)"  | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination | sort - Time