Parsing XML - ignore new line

sbaror11 — Wed, 11 Nov 2020 13:23:03 GMT

I am trying to parse a complex xml and asking about the regex for SEDCMD-abremoveheader which refers to line 3 of the xml or further below. (*s) works in regex101.com but not in Splunk SEDCMD-abremoveheader.

The below solution is NOT SUFFICIENT because it refers to the first 2 lines only.
https://community.splunk.com/t5/Getting-Data-In/Parsing-XML-and-props-conf-help/m-p/158263

Details:

I use SEDCMD-abremoveheader to start from the desired location.
I works when it is about the first two lines.
It does not work when it is the 3rd or any other line further below.

Here is an example xml:

<?xml version="1.0"?>
<config version="8.1.0" daaa="dummy">
<something>

The following works fine in Splunk xml parsing:

SEDCMD-abremoveheader = s/\<\?xml.*\s*\<config.*\>\s*//g

The following does not work in splunk xml parsing and also not in regex101.com

SEDCMD-abremoveheader = s/\<\?xml.*\s*\<somthing.*\>\s*//g

The following ***works in regx101.com*** but not in Splunk xml parsing:

(?s)\<\?xml.*\s*\<something.*\>\s*

The (?s) says to ignore any char including new lines.
Also tried (?m) - does not work either.

topic Parsing XML - ignore new line in Getting Data In

Parsing XML - ignore new line