How to deal with deafult namespace when searching using xpath in splunk? - xpath

Question

So I have a valid xml file looking something like this:
<session xmlns="http://winscp.net/schema/session/1.0" name="mysession#10.0.0.22" start="2015-09-28T05:00:01.974Z">
<ls>
<destination value="/" />
<files>
<file>
<filename value="." />
<type value="d" />
<modification value="2015-09-28T05:44:14.000Z" />
<permissions value="rw-rw----" />
</file>
<file>
<filename value=".." />
<type value="d" />
<modification value="2015-09-28T05:44:14.000Z" />
<permissions value="rw-rw----" />
</file>
<file>
<filename value="55800379_150928_071525.zip" />
<type value="-" />
<size value="999124" />
<modification value="2015-09-28T05:36:08.000Z" />
<permissions value="rw-rw----" />
</file>
</files>
<result success="true" />
</ls>
<download>
<filename value="/55800379_150928_071525.zip" />
<destination value="C:\somefolder\55800478_150928_071525.zip" />
<result success="true" />
</download>
<rm>
<filename value="/55800379_150928_071525.zip" />
<result success="true" />
</rm>
</session>
I have added it as data in splunk and am trying to search using a query as below:
source="sample5.xml" host="dummy1" sourcetype="WinSCP XML" | xpath outfield=afield "//ls/files/file/filename/#value"
However, in this case the afield field is not getting populated (I was expecting the three values '.', '..' and '55800379_150928_071525.zip'). So I've got the error down to the xmlns in the session tag, when the first line looks like this (note: no xmlns attribute), the search does what I expect:
<session name="mysession#10.0.0.22" start="2015-09-28T05:00:01.974Z">
What do I have to put in my xpath to get the result I am looking for (I would very much prefer not to have to preprocess my logs to remove the XML namespace prior to import)?

Answer 1

Hmm, that looks like an unnamed namespace, which I can get at by registering a custom namespace prefix using my libxml2 wrapper program:
$ xpquery -n 'x:http://winscp.net/schema/session/1.0' '//x:ls/x:files/x:file/x:filename/#value' blah.xml
value="."
value=".."
value="55800379_150928_071525.zip"
$
Check whether your xpath program has support for the equivalent of libxml2 registerNs functionality?