New to Splunk and have below XML:
When searching for all attr values, it only receives the value of the first element (i.e. "a"):
index=* scenario=y "some search criteria" | table attr
I get the same result even if the result is piped into an xpath expression:
index=* scenario=y "some search criteria" | xpath max_match=0 "//order/lineitems/lineitem[2]/@attr" | table attr
↧