topic Re: display specific content from message in Dashboards & Visualizations

display specific content from message

Leon88 — Mon, 30 Oct 2023 07:54:51 GMT

I have a below message. how can I only display ResponseID in output? thanks

message: <?xml version='1.0' encoding='ISO-8859-1'?><Submission Id="12345" <LastName>XXX</LastName><ResponseID>137ce83fe8ddb052-1698535326634</ResponseID><Date>2023.10.28 23:23:14</Date>

Re: display specific content from message

gcusello — Mon, 30 Oct 2023 08:30:47 GMT

Hi @Leon88,

you have to use a regex to extract this field, something like this:

index=your_index | rex "\<ResponseID\>(?<ResponseID>[^\<]*)" | table _time ResponseID

that you can test at https://regex101.com/r/Sj8hDe/1

Ciao.

Giuseppe

Re: display specific content from message

gcusello — Mon, 30 Oct 2023 08:39:24 GMT

Hi @Leon88 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉