New comment on reddit

IIRC… XML works like JSON, which means the first thing you'd need to do is mvzip the fields together (followed by an mvexpand) … or use mvfind and mvindex

Here should be a couple ways to do it (note: I don't have any similar data to try this on, so it's more of an educated guess than an exact suggestion, but should put you on the right track):

<search> | eval tablename=mvindex("people.person.name",mvfind("people.person.age","41")) | stats count by tablename 

If that doesn't work, try this one:

<search> | eval comfield=mvzip("people.person.age","people.person.name","|") | mvexpand comfield | search comfield="41*" | rex field=comfield "|(?<name>.+)" | stats count by name 

April 28, 2020 at 11:54AM
via reddit https://www.reddit.com/r/Splunk/comments/g9nyep/nested_xml_search/fourq5u?utm_source=ifttt