需要在 Splunk 中创建一个嵌套表或多列的表

Question

我有一个有效的 Splunk 搜索，它从日志语句中的 xml 文件中提取数据。搜索会创建一个包含 14 列的表。以下是创建此表的查询

<sourcetype and other data>..| xmlkv  | rex max_match=0 "\<ns2\:numberCode\>(?P<location>[^\<]+)"| eval Segment1_Origin =  mvindex(location, 7), Segment1_Destination = mvindex(location, 8), Segment2_Origin = mvindex(location, 10), Segment2_Destination = mvindex(location, 11), Segment3_Origin = mvindex(location, 13), Segment3_Destination = mvindex(location, 14)  |  rex max_match=0 "\<carrier\>(?P<carrier>[^\<]+)" | eval Segment1_Carrier =  mvindex(carrier, 0), Segment2_Carrier = mvindex(carrier, 1), Segment3_Carrier = mvindex(carrier, 2) |  rex max_match=0 "\<billingMethod\>(?P<billingMethod>[^\<]+)" | eval Segment1_BillingMethod =  mvindex(billingMethod, 0), Segment2_BillingMethod = mvindex(billingMethod, 1), Segment3_BillingMethod = mvindex(billingMethod, 2) | table purchCostReference, eventType, Segment1_Carrier, Segment1_BillingMethod, Segment1_Origin, Segment1_Destination, Segment2_Carrier, Segment2_BillingMethod, Segment2_Origin, Segment2_Destination, Segment3_Carrier, Segment3_BillingMethod, Segment3_Origin, Segment3_Destination | sort purchCostReference, eventType

表格如下所示（所有列因大小而未显示）：

我希望表格以某种方式由 Segments 嵌套。

或者像这样：

在 Splunk 中是否可以使用这些表格设计中的任何一种？

Answer 1

这就是我创建表的第二个实例的方式。添加了时间字段。使用这些命令，我​​解析了 xml 中所需的值

sourcetype... |xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments =  mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)"  | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination | sort - Time