https://community.splunk.com/t5/Getting-Data-In/trying-to-lexically-parse-a-text-field-and-group-results-into/m-p/209732#M96166 <P>You can parse XML data using either spath or xpath command.</P> Thu, 29 Dec 2016 06:18:25 GMT niketn 2016-12-29T06:18:25Z https://community.splunk.com/t5/Getting-Data-In/trying-to-lexically-parse-a-text-field-and-group-results-into/m-p/209731#M96165 <P>I have an xml file with a text field. The text field may include trigger words. I have a list of those trigger words. Obviously I can search for those trigger words from the text field by using wildcards. I don't want to do sub-searches for every possible correlation.</P> <P>So my description might be "item rejected because expiration date is wrong" or "security violation" or "date of birth missing, application rejected" and my keywords might be "rejected", "expiration", "security", or "violation".</P> <P>Is there a way to do a lookup using the wildcard by way of substitution? Would you use a regex?</P> <P>I'd like to be able to group the results by trigger word.</P> Thu, 29 Dec 2016 00:14:53 GMT https://community.splunk.com/t5/Getting-Data-In/trying-to-lexically-parse-a-text-field-and-group-results-into/m-p/209731#M96165 brucejohnson 2016-12-29T00:14:53Z https://community.splunk.com/t5/Getting-Data-In/trying-to-lexically-parse-a-text-field-and-group-results-into/m-p/209732#M96166 <P>You can parse XML data using either spath or xpath command.</P> Thu, 29 Dec 2016 06:18:25 GMT https://community.splunk.com/t5/Getting-Data-In/trying-to-lexically-parse-a-text-field-and-group-results-into/m-p/209732#M96166 niketn 2016-12-29T06:18:25Z