topic Re: How to extract "myuserid" from my _raw event? in Splunk Search

How to extract "myuserid" from my _raw event?

sravankaripe — Tue, 07 Mar 2017 15:03:01 GMT

i want to retrieve myuserid from the below _raw event. please help me with rex in search.

<name>userid</name>\n <lvalue>\n <string>myuserid</string>\n

Re: How to extract "myuserid" from my _raw event?

somesoni2 — Tue, 07 Mar 2017 15:23:00 GMT

Is it really a \n string in your data or they are representing new line? (your data is multiline)?

Also check if this works

your base search | rex "\<name\>userid([^\>]+\>){3}(?<userid>[^\<]+)"

Re: How to extract "myuserid" from my _raw event?

koshyk — Tue, 07 Mar 2017 15:23:22 GMT

Few assumptions
- Hope the above is NOT pure xml?
- assuming is a unique xml tag for myuserid

the regex is

| rex field=_raw "\<string\>(?<myuseridValue>.*)\<\/string\>"

Example query

| makeresults | eval _raw="<name>userid</name>\n <lvalue>\n <string>myuserid</string>\n " | rex field=_raw "\<string\>(?<myuseridValue>.*)\<\/string\>"| table _raw,myuseridValue

Re: How to extract "myuserid" from my _raw event?

sravankaripe — Tue, 07 Mar 2017 15:26:52 GMT

\n is a string

Re: How to extract "myuserid" from my _raw event?

somesoni2 — Tue, 07 Mar 2017 17:29:48 GMT

Did you try the search I suggested?

Re: How to extract "myuserid" from my _raw event?

woodcock — Tue, 07 Mar 2017 18:53:42 GMT

Try this:

... | rex "(?ms)<name>userid<\/name>[\r\n]*<lvalue>[\r\n]<string>(?<userid>.*)<\/string>"