https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90625#M18816 <P>a regex will always do the magic you need</P> <PRE><CODE>| rex "\smessage=\"(?P&lt;FIELDNAME&gt;[^\"]+)\"" </CODE></PRE> Thu, 11 Jul 2013 21:09:10 GMT asimagu 2013-07-11T21:09:10Z https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90624#M18815 <P>I have XML data stored for an field in my Splunk events and am looking to extract an attribute contained within one of the elements For example, an event will look like</P> <P><CODE><BR /> LogName=Application<BR /> SourceName=MyApplication<BR /> Type=Error<BR /> Message=&lt;Exception type="SomeType.Value" message="The value I wanted" ....&gt;&lt;/Exception&gt;<BR /> ....<BR /> </CODE></P> <P>How can I extract the message attribute values for the matching events? </P> Wed, 10 Jul 2013 09:22:55 GMT https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90624#M18815 paddy3883 2013-07-10T09:22:55Z https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90625#M18816 <P>a regex will always do the magic you need</P> <PRE><CODE>| rex "\smessage=\"(?P&lt;FIELDNAME&gt;[^\"]+)\"" </CODE></PRE> Thu, 11 Jul 2013 21:09:10 GMT https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90625#M18816 asimagu 2013-07-11T21:09:10Z https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90626#M18817 <P>Excellent, many thanks. This worked a treat</P> Wed, 17 Jul 2013 15:10:22 GMT https://community.splunk.com/t5/Getting-Data-In/Extracting-XML-data-attributes-from-message-field/m-p/90626#M18817 paddy3883 2013-07-17T15:10:22Z