topic Re: remove specific xml element with attribute (only start tag) in Splunk Enterprise Security

How to remove specific xml element with attribute (only start tag)?

dmuley — Thu, 16 Jun 2022 20:44:15 GMT

I have the event that looks like below

2022-06-15 19:59:57.489 threadId=L4GFP2275S1K class="ActiveSession" mname="NA" callId="NA" eventType="InMsg" data="<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><TestRQ><Merchant_ID>testmid</Merchant_ID></TestRQ>"

and I would like to remove below xml element with attribute from data fields , How can I do that ?

<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

Results I want is

2022-06-15 19:59:57.489 threadId=L4GFP2275S1K class="ActiveSession" mname="NA" callId="NA" eventType="InMsg" data="<TestRQ><Merchant_ID>testmid</Merchant_ID></TestRQ>"

@ITWhisperer

Re: remove specific xml element with attribute (only start tag)

ITWhisperer — Thu, 16 Jun 2022 06:09:24 GMT

| rex mode=sed "s/data=\"<[^>]+>/data=\"/g"

Re: remove specific xml element with attribute (only start tag)

dmuley — Thu, 16 Jun 2022 06:23:54 GMT

@ITWhisperer Sorry but this is specific element and its placement is not necessarily to start of the data field.

So in short I need to remove anything that starts with <InfoNox_Interface and ends with >.

below string should be replaced with nothing.

<InfoNox_Interface xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

Re: remove specific xml element with attribute (only start tag)

ITWhisperer — Thu, 16 Jun 2022 06:30:12 GMT

Is there anything else you forgot to mention? 😀

| rex mode=sed "s/\<InfoNox_Interface xmlns:xsd=\"http:\/\/www\.w3\.org\/2001\/XMLSchema\" xmlns:xsi=\"http:\/\/www\.w3\.org\/2001\/XMLSchema-instance\"\>//g"

Re: remove specific xml element with attribute (only start tag)

dmuley — Thu, 16 Jun 2022 06:33:53 GMT

Yes you are such a kind person. thanks a lot @ITWhisperer