topic Re: Why is Splunk query to extract string inside XML tag not working with spath command? in Dashboards & Visualizations

Why is Splunk query to extract string inside XML tag not working with spath command?

maximusdm — Wed, 03 Oct 2018 18:36:53 GMT

I am using the following query:

index=itx "PAD =" | dedup BOC | spath output=Channel path=AsRunMessage.Header.Channel  | table BOC, channel

which results in events with big XML content .. I need to extract the string "ITX1546" from inside the tags.

Also, I need to create a table with distinct rows containing unique BOC values.

The Channel field is not being populated.

Here is the XML structure:

Any ideas? Thank you

maximusdm — Fri, 05 Oct 2018 15:11:42 GMT

found my own answer.. .rex "]+>(?[^<]+)"

maximusdm — Fri, 05 Oct 2018 15:13:01 GMT

rex "<Channel [^>]+>(?<Channel>[^<]+)"