topic Re: How to create the Regular Expression for the xml in Splunk Search

How to create the Regular Expression for the xml

m7787580 — Thu, 22 Jun 2017 15:48:03 GMT

Hi Team,

I have XML in the format present below and i am trying to use field transformation and field extraction in order to extract the field in people format.

Could you please help me in creating regular expression for this xml

<ns4:includeme>false</ns4:includeme>
<m:houseref>21</m:houseref>
<m1:security>***</m1:security>
<Name>Argus</Name>

I would like to have a single regular expression which i can use to extract all the field values and field name.

I tried to use below

- \<\w?\w?\d?\:([^\>]+)\>([^\<]+)\<\/

But its not capturing the last one Argus

So i would like to know if it can be possible if yes then what would be the expression.

Many Thanks

Re: How to create the Regular Expression for the xml

niketn — Thu, 22 Jun 2017 17:37:48 GMT

@m7787580, any reason you are not using spath or xpath command?

Re: How to create the Regular Expression for the xml

richgalloway — Thu, 22 Jun 2017 17:59:01 GMT

Your regex string was very close. The colon is optional so I put a question mark after it in the regex. This worked for me on regex101.com with your sample data.

\<\w?\w?\d?\:?([^\>]+)\>([^\<]+)\<\/

Re: How to create the Regular Expression for the xml

woodcock — Thu, 22 Jun 2017 20:01:23 GMT

Why not use spath (you can certainly go with @richgalloway's answer)?

Re: How to create the Regular Expression for the xml

m7787580 — Fri, 23 Jun 2017 08:35:30 GMT

Thanks for coming back to me.

 <Na**me**>Argus</Name>

Then it is only capturing me part from Name and i want full Name to be rexed out.

Many Thanks,

Re: How to create the Regular Expression for the xml

m7787580 — Fri, 23 Jun 2017 09:50:17 GMT

Hi Richgalloway's

I am not sure how to use spath.

If you help me in understanding the syntax and usage it would be helpfull.

Many Thanks,

Re: How to create the Regular Expression for the xml

woodcock — Fri, 23 Jun 2017 10:01:36 GMT

You are going to LOVE this. Just add this to the end of your existing search and freak out:

| spath

Re: How to create the Regular Expression for the xml

m7787580 — Fri, 23 Jun 2017 10:21:20 GMT

Hi wood,

I still cannot see the fields getting extracted 😞

Re: How to create the Regular Expression for the xml

woodcock — Sat, 24 Jun 2017 16:03:27 GMT

Try this and then figure out what is what is wonky in your search (by default it works from the _raw field)

| makeresults
| eval _raw="<ns4:includeme>false</ns4:includeme>
<m:houseref>21</m:houseref>
<m1:security>***</m1:security>
<Name>Argus</Name>"
| spath