https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383609#M112041 <P>Thanks. I'll go with that for now until I find a better solution. </P> Thu, 02 Aug 2018 16:52:52 GMT kmaron 2018-08-02T16:52:52Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383597#M112029 <P>I'm still not overly comfortable with regex and this has completely stumped me so I'm looking for help. I'm trying to break up this XML into fields so I can show them on a dashboard in my inline search. </P> <P>My event looks like this:</P> <PRE><CODE> &lt;Header name="$WSIS"&gt; &lt;Value&gt;false&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSPR"&gt; &lt;Value&gt;HTTP/1.1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSRA"&gt; &lt;Value&gt;##.#.##.##1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSRH"&gt; &lt;Value&gt;##.#.##.##2&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSSC"&gt; &lt;Value&gt;http&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSSN"&gt; &lt;Value&gt;www.website.com&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSSP"&gt; &lt;Value&gt;80&lt;/Value&gt; &lt;/Header&gt; </CODE></PRE> <P>I need to break out each Header name and keep it with it's value so that I can show a table of each header name and subsequent value. </P> <P>I can get the individual fields but I haven't been able to keep them paired up. </P> Thu, 02 Aug 2018 13:47:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383597#M112029 kmaron 2018-08-02T13:47:52Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383598#M112030 <P>Is there no other info in the results? It will be easier if we have more at either end of the result.</P> Thu, 02 Aug 2018 14:07:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383598#M112030 jodyfsu 2018-08-02T14:07:52Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383599#M112031 <P>Never mind, I have something. I should have it completed shortly.</P> Thu, 02 Aug 2018 14:10:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383599#M112031 jodyfsu 2018-08-02T14:10:26Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383600#M112032 <P>the section in question starts and ends with <CODE>&lt; Headers &gt;</CODE> and <CODE>&lt; /Headers &gt;</CODE> but everything else before and after those tags varies. </P> Thu, 02 Aug 2018 14:11:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383600#M112032 kmaron 2018-08-02T14:11:13Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383601#M112033 <P>the spaces aren't really there. it's the only way it would work in the comment. </P> Thu, 02 Aug 2018 14:12:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383601#M112033 kmaron 2018-08-02T14:12:43Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383602#M112034 <P>This should work</P> <PRE><CODE>| rex "^.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD1&gt;.[^\"]+)\"\&gt;\n.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD1_VAL&gt;.[^\&lt;]+)\&lt;\/Value\&gt;\s.[^\&lt;]+\&lt;\/Header\&gt;\s.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD2&gt;.[^\"]+)\"\&gt;\s.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD2_VAL&gt;.[^\&lt;]+)\&lt;\/Value\&gt;\s.[^\&lt;]+\&lt;\/Header\&gt;\s.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD3&gt;.[^\"]+)\"\&gt;\s.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD3_VAL&gt;.[^\&lt;]+)\&lt;\/Value\&gt;\s.[^\&lt;]+\&lt;\/Header\&gt;\s.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD4&gt;.[^\"]+)\"\&gt;\s.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD4_VAL&gt;.[^\&lt;]+)\&lt;\/Value\&gt;\s.[^\&lt;]+\&lt;\/Header\&gt;\s.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD5&gt;.[^\"]+)\"\&gt;\s.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD5_VAL&gt;.[^\&lt;]+)\&lt;\/Value\&gt;\s.[^\&lt;]+\&lt;\/Header\&gt;\s.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD6&gt;.[^\"]+)\"\&gt;\s.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD6_VAL&gt;.[^\&lt;]+)\&lt;\/Value\&gt;\s.[^\&lt;]+\&lt;\/Header\&gt;\s.[^\&lt;]+\&lt;Header\sname\=\"(?&lt;HEAD7&gt;.[^\&gt;]+)\&gt;\s.[^\&lt;]+\&lt;Value\&gt;(?&lt;HEAD7_VAL&gt;.[^\&lt;]+)\&lt;" | table HEAD1 HEAD1_VAL HEAD2 HEAD2_VAL HEAD3 HEAD3_VAL HEAD4 HEAD4_VAL HEAD5 HEAD5_VAL HEAD6 HEAD6_VAL HEAD7 HEAD7_VAL </CODE></PRE> <P>Let us know if you are looking for something different.</P> Thu, 02 Aug 2018 14:48:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383602#M112034 jodyfsu 2018-08-02T14:48:21Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383603#M112035 <P>I can make that work but I have an unknown number of header values. I've seen as many as 39 on different events. </P> Thu, 02 Aug 2018 14:52:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383603#M112035 kmaron 2018-08-02T14:52:27Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383604#M112036 <P>can you try defining it in props and transforms</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Propsconf">props.conf</A></P> <PRE><CODE> [yourSourceType] NO_BINARY_CHECK = 1 TIME_FORMAT = %a %b %d %H:%M:%S %T %Y pulldown_type = 1 REPORT-xmlkv = xmlkv-alternative </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Transformsconf">transforms.conf</A></P> <PRE><CODE> [xmlkv-alternative] REGEX = &lt;([^\s\&gt;]*)[^\&gt;]*\&gt;([^&lt;]*)\&lt;\/\1\&gt; FORMAT = $1::$2 </CODE></PRE> Thu, 02 Aug 2018 15:16:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383604#M112036 soumyasaha25 2018-08-02T15:16:22Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383605#M112037 <P>Hmm.. You could add the additional HEAD* HEAD*_VAL as needed, it will only get populated if there is data.</P> Thu, 02 Aug 2018 15:17:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383605#M112037 jodyfsu 2018-08-02T15:17:35Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383606#M112038 <P>No. I don't have access to those. It has to be in the SPL. </P> Thu, 02 Aug 2018 15:17:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383606#M112038 kmaron 2018-08-02T15:17:46Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383607#M112039 <P>try this</P> <PRE><CODE>your search | rex field=_raw ".*?\&lt;Header\sname\=\"\$(?P&lt;header_name&gt;.*?)\"\&gt;\s+\&lt;Value\&gt;(?P&lt;value&gt;.*?)\&lt;\/Value\&gt;" </CODE></PRE> Thu, 02 Aug 2018 16:21:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383607#M112039 soumyasaha25 2018-08-02T16:21:55Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383608#M112040 <P>that's essentially what I have. it gets me one header name and one value. </P> Thu, 02 Aug 2018 16:52:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383608#M112040 kmaron 2018-08-02T16:52:36Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383609#M112041 <P>Thanks. I'll go with that for now until I find a better solution. </P> Thu, 02 Aug 2018 16:52:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383609#M112041 kmaron 2018-08-02T16:52:52Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383610#M112042 <P>Hi there,</P> <P>Can you give this a try and see if it works for you. You can run this search as is.</P> <PRE><CODE>| makeresults | eval _raw = "&lt;Header name=\"$WSIS\"&gt;&lt;Value&gt;false&lt;/Value&gt;&lt;/Header&gt;&lt;Header name=\"$WSPR\"&gt;&lt;Value&gt;HTTP/1.1&lt;/Value&gt;&lt;/Header&gt;&lt;Header name=\"$WSRA\"&gt;&lt;Value&gt;##.#.##.##1&lt;/Value&gt;&lt;/Header&gt;&lt;Header name=\"$WSRH\"&gt;&lt;Value&gt;##.#.##.##2&lt;/Value&gt;&lt;/Header&gt;&lt;Header name=\"$WSSC\"&gt;&lt;Value&gt;http&lt;/Value&gt;&lt;/Header&gt;&lt;Header name=\"$WSSN\"&gt;&lt;Value&gt;www.website.com&lt;/Value&gt;&lt;/Header&gt;&lt;Header name=\"$WSSP\"&gt;&lt;Value&gt;80&lt;/Value&gt;&lt;/Header&gt;" | spath output=name path=Header{@name} | spath output=Value path=Header.Value | table name Value </CODE></PRE> <P>If you want to test this against your data, then add below at the end of your search and modify name and value appropriately.<BR /> <CODE>...<BR /> | spath output=name path=Header{@name} <BR /> | spath output=Value path=Header.Value <BR /> | table name Value</CODE></P> Thu, 02 Aug 2018 17:09:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383610#M112042 sudosplunk 2018-08-02T17:09:32Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383611#M112043 <P>I don't really understand how what you're showing me will work with my event. your raw is not at all like mine. </P> Thu, 02 Aug 2018 17:15:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383611#M112043 kmaron 2018-08-02T17:15:14Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383612#M112044 <P>Sorry, I forgot to paste it in <CODE>Code sample</CODE>.Splunk doesn't properly catch xml tags if not pasted in Code sample. I modified my comment above. Please note that I escaped <CODE>"</CODE> to satisfy <CODE>eval</CODE>. </P> Thu, 02 Aug 2018 17:18:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383612#M112044 sudosplunk 2018-08-02T17:18:49Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383613#M112045 <P>okay with your run anywhere example it works great. But I don't see how I make that work for my actual data. Maybe I didn't provide enough info. The list of headers is only a portion of a 500 line block of XML</P> Thu, 02 Aug 2018 17:29:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383613#M112045 kmaron 2018-08-02T17:29:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383614#M112046 <P>Can you provide how actual headers and values look like. You can mask unwanted info.</P> Thu, 02 Aug 2018 17:32:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383614#M112046 sudosplunk 2018-08-02T17:32:39Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383615#M112047 <PRE><CODE>&lt;WebError email="###" jira="###" application_name="###" uuid="###" classType="com.###.xml.gen.WebError" dateTime="2018-08-02T07:41:34.685-04:00"&gt; &lt;Throwable classType="java.lang.IllegalStateException" value="java.lang.IllegalStateException" message="null" runningTotal="1"&gt; &lt;Details&gt;java.lang.IllegalStateException at com.ibm.ws.session.http.HttpSessionImpl.isNew(HttpSessionImpl.java:313) at com.ibm.ws.session.SessionContext.doSecurityCheck(SessionContext.java:559) at com.ibm.ws.session.SessionContext.getIHttpSession(SessionContext.java:519) at com.ibm.ws.session.SessionContext.getIHttpSession(SessionContext.java:426) at com.ibm.ws.webcontainer.srt.SRTRequestContext.getSession(SRTRequestContext.java:113) at com.ibm.ws.webcontainer.srt.SRTServletRequest.getSession(SRTServletRequest.java:2212) at com.ibm.ws.webcontainer.srt.SRTServletRequest.getSession(SRTServletRequest.java:2196) at com.aoins.logging.LoggerFilter.doFilter(LoggerFilter.java:35) at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:195) at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:91) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:967) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1107) at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:87) at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:949) at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817) at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:200) at com.ibm.ws390.xmem.proxy.channel.XMemProxySRInboundConnLink.ready(XMemProxySRInboundConnLink.java:105) at com.ibm.ws390.xmem.proxy.channel.XMemProxySRInboundChannel.processNewConnection(XMemProxySRInboundChannel.java:123) at com.ibm.ws390.xmem.proxy.XMemProxySRCppUtilities.httpinvoke(XMemProxySRCppUtilities.java:150) at com.ibm.ws390.orb.ServerRegionBridge.httpinvoke(ServerRegionBridge.java:213) at com.ibm.ws390.orb.CommonBridge.getAndProcessWork(CommonBridge.java:683) at com.ibm.ws390.orb.CommonBridge.runApplicationThread(CommonBridge.java:614) at com.ibm.ws.util.ThreadPool$ZOSWorker.run(ThreadPool.java:2127) &lt;/Details&gt; &lt;/Throwable&gt; &lt;Request&gt; &lt;Session created="true"&gt; &lt;SessionInfo valid="true" source="COOKIE" id="###" creationTime="2018-08-02T07:41:34.359-04:00" lastAccessedTime="2018-08-02T07:41:34.680-04:00" maxInactiveInterval="1800" new="false"/&gt; &lt;/Session&gt; &lt;Parameters/&gt; &lt;Attributes&gt; &lt;ApplicationScope&gt; &lt;Attribute name="com.ibm.websphere.servlet.application.classpath" value="*VALUE REMOVED*" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.websphere.servlet.application.host" value="###" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.websphere.servlet.application.name" value="###" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.websphere.servlet.enterprise.application.name" value="###" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.websphere.servlet.event.ServletContextEventSource" value="com.ibm.ws.webcontainer.webapp.WebAppEventSource@a0f4f3f7" classType="com.ibm.ws.webcontainer.webapp.WebAppEventSource"/&gt; &lt;Attribute name="com.ibm.ws.jsf.JSF_IMPL_ENABLED" value="None" classType="com.ibm.ws.jsf.JSFConstants$JSFImplEnabled"/&gt; &lt;Attribute name="com.ibm.ws.jsp.servletContextListeners.contextInitialized" value="true" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.ws.webcontainer.config.WelcomeFileList" value="[index.html, index.htm, index.jsp]" classType="java.util.ArrayList"/&gt; &lt;Attribute name="com.ibm.ws.webcontainer.webAppPmiListener" value="com.ibm.ws.webcontainer.WebAppPmiListener@439c3f08" classType="com.ibm.ws.webcontainer.WebAppPmiListener"/&gt; &lt;Attribute name="com.ibm.wsspi.portletcontainer" value="com.ibm.ws.portletcontainer.pcinvoker.PortletContainerImpl@2a527a26" classType="com.ibm.ws.portletcontainer.pcinvoker.PortletContainerImpl"/&gt; &lt;Attribute name="CONFIGURATION_CONTEXT" value="org.apache.axis2.context.ConfigurationContext@c9df7dbd" classType="org.apache.axis2.context.ConfigurationContext"/&gt; &lt;Attribute name="javax.faces.validator.beanValidator.ValidatorFactory" value="com.ibm.ws.beanvalidation.WASProxyValidatorFactory@1011fd1c" classType="com.ibm.ws.beanvalidation.WASProxyValidatorFactory"/&gt; &lt;Attribute name="javax.servlet.context.tempdir" value="###" classType="java.io.File"/&gt; &lt;Attribute name="JCDI_ENABLED" value="false" classType="java.lang.Boolean"/&gt; &lt;Attribute name="org.apache.jasper.runtime.JspApplicationContextImpl" value="org.apache.jasper.runtime.JspApplicationContextImpl@4ebe686b" classType="org.apache.jasper.runtime.JspApplicationContextImpl"/&gt; &lt;Attribute name="org.apache.wink.server.internal.RequestProcessor" value="org.apache.wink.server.internal.RequestProcessor@fa506c7a" classType="org.apache.wink.server.internal.RequestProcessor"/&gt; &lt;Attribute name="org.springframework.web.context.support.ServletContextScope" value="org.springframework.web.context.support.ServletContextScope@b160b6b9" classType="org.springframework.web.context.support.ServletContextScope"/&gt; &lt;Attribute name="org.springframework.web.context.WebApplicationContext.ROOT" value="Root WebApplicationContext: startup date [Thu Aug 02 03:20:04 EDT 2018]; root of context hierarchy" classType="org.springframework.web.context.support.XmlWebApplicationContext"/&gt; &lt;Attribute name="org.springframework.web.servlet.FrameworkServlet.CONTEXT.Spring" value="WebApplicationContext for namespace 'Spring-servlet': startup date [Thu Aug 02 03:20:26 EDT 2018]; parent: Root WebApplicationContext" classType="org.springframework.web.context.support.AnnotationConfigWebApplicationContext"/&gt; &lt;Attribute name="###" value="org.apache.wink.server.internal.lifecycle.metadata.EJBMetadata@c7f8ea3b" classType="org.apache.wink.server.internal.lifecycle.metadata.EJBMetadata"/&gt; &lt;/ApplicationScope&gt; &lt;SessionScope/&gt; &lt;RequestScope&gt; &lt;Attribute name="com.aoins.errorhandler.ErrorHandlerAttribute.EH_TIME" value="August 02, 2018 07:41:34 AM" classType="java.lang.String"/&gt; &lt;Attribute name="com.aoins.errorhandler.ErrorHandlerAttribute.EH_UUID" value="###" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.servlet.engine.webapp.dispatch_nested" value="true" classType="java.lang.String"/&gt; &lt;Attribute name="com.ibm.servlet.engine.webapp.dispatch_type" value="forward" classType="java.lang.String"/&gt; &lt;Attribute name="ErrorReport" value="com.ibm.ws.webcontainer.webapp.WebAppErrorReport: java.lang.IllegalStateException" classType="com.ibm.ws.webcontainer.webapp.WebAppErrorReport"/&gt; &lt;Attribute name="javax.servlet.error.exception" value="java.lang.IllegalStateException" classType="java.lang.IllegalStateException"/&gt; &lt;Attribute name="javax.servlet.error.exception_type" value="class java.lang.IllegalStateException" classType="java.lang.Class"/&gt; &lt;Attribute name="javax.servlet.error.message" value="java.lang.IllegalStateException" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.error.request_uri" value="/V5/Auto/static/css/vehicleLookup.css" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.error.servlet_name" value="Static File wrapper" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.error.status_code" value="500" classType="java.lang.Integer"/&gt; &lt;Attribute name="javax.servlet.forward.context_path" value="###" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.forward.path_info" value="###" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.forward.request_uri" value="/V5/Auto/static/css/vehicleLookup.css" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.forward.servlet_path" value="" classType="java.lang.String"/&gt; &lt;Attribute name="javax.servlet.jsp.jspException" value="com.ibm.ws.webcontainer.webapp.WebAppErrorReport: java.lang.IllegalStateException" classType="com.ibm.ws.webcontainer.webapp.WebAppErrorReport"/&gt; &lt;/RequestScope&gt; &lt;/Attributes&gt; &lt;Cookies&gt; ### &lt;/Cookies&gt; &lt;Headers&gt; &lt;Header name="$WSIS"&gt; &lt;Value&gt;false&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSPR"&gt; &lt;Value&gt;HTTP/1.1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSRA"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSRH"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSSC"&gt; &lt;Value&gt;http&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSSN"&gt; &lt;Value&gt;www.###.com&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSSP"&gt; &lt;Value&gt;80&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="$WSXCTCONTEXTID"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="_WS_HAPRT_WLMVERSION"&gt; &lt;Value&gt;-1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Accept"&gt; &lt;Value&gt;text/css, */*&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Accept-Language"&gt; &lt;Value&gt;en-US&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Cookie"&gt; &lt;Value&gt;*VALUE REMOVED*&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="DNT"&gt; &lt;Value&gt;1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Host"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="If-Modified-Since"&gt; &lt;Value&gt;Mon, 30 Jul 2018 17:07:34 GMT&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Referer"&gt; &lt;Value&gt;https://www.google.com&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Surrogate-Capability"&gt; &lt;Value&gt;WS-ESI="ESI/1.0+"&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="User-Agent"&gt; &lt;Value&gt;Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="clientip"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="ssodbg"&gt; &lt;Value&gt;3&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="TLSLog"&gt; &lt;Value&gt;TLSv1.2&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="Username"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name="X-Forwarded-Proto"&gt; &lt;Value&gt;https&lt;/Value&gt; &lt;/Header&gt; &lt;/Headers&gt; &lt;OriginalRequestedURI&gt;###&lt;/OriginalRequestedURI&gt; &lt;RequestedURI&gt;###&lt;/RequestedURI&gt; &lt;OriginalQueryString&gt;null&lt;/OriginalQueryString&gt; &lt;QueryString&gt;null&lt;/QueryString&gt; &lt;ServletName&gt;Static File wrapper&lt;/ServletName&gt; &lt;StatusCode&gt;500&lt;/StatusCode&gt; &lt;CharacterEncoding&gt;null&lt;/CharacterEncoding&gt; &lt;ContentLength&gt;-1&lt;/ContentLength&gt; &lt;ContentType&gt;null&lt;/ContentType&gt; &lt;Secure&gt;true&lt;/Secure&gt; &lt;Method&gt;GET&lt;/Method&gt; &lt;AuthorizationType&gt;BASIC&lt;/AuthorizationType&gt; &lt;PathInfo&gt;null&lt;/PathInfo&gt; &lt;PathTranslated&gt;null&lt;/PathTranslated&gt; &lt;Client host="###" address="###" remoteUser="###" port="###"&gt; &lt;Locale language="en" country="US"/&gt; &lt;/Client&gt; &lt;Server host="###" port="###"/&gt; &lt;WASServer serverName="###" jobNumber="###"/&gt; &lt;LocalInterface host="###" address="###0" port="###"/&gt; &lt;/Request&gt; &lt;/WebError&gt; </CODE></PRE> Thu, 02 Aug 2018 17:43:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383615#M112047 kmaron 2018-08-02T17:43:28Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383616#M112048 <P>Please run the search below and see if it works for you. If yes, all you need to is, add <CODE>|spath</CODE> at the end of your search query. More info about <A href="http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Spath">spath</A> command.</P> <PRE><CODE>| makeresults | eval _raw = "&lt;WebError email=\"###\" jira=\"###\" application_name=\"###\" uuid=\"###\" classType=\"com.###.xml.gen.WebError\" dateTime=\"2018-08-02T07:41:34.685-04:00\"&gt; &lt;Throwable classType=\"java.lang.IllegalStateException\" value=\"java.lang.IllegalStateException\" message=\"null\" runningTotal=\"1\"&gt; &lt;Details&gt;java.lang.IllegalStateException at com.ibm.ws.session.http.HttpSessionImpl.isNew(HttpSessionImpl.java:313) at com.ibm.ws.session.SessionContext.doSecurityCheck(SessionContext.java:559) at com.ibm.ws.session.SessionContext.getIHttpSession(SessionContext.java:519) at com.ibm.ws.session.SessionContext.getIHttpSession(SessionContext.java:426) at com.ibm.ws.webcontainer.srt.SRTRequestContext.getSession(SRTRequestContext.java:113) at com.ibm.ws.webcontainer.srt.SRTServletRequest.getSession(SRTServletRequest.java:2212) at com.ibm.ws.webcontainer.srt.SRTServletRequest.getSession(SRTServletRequest.java:2196) at com.aoins.logging.LoggerFilter.doFilter(LoggerFilter.java:35) at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:195) at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:91) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:967) at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1107) at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:87) at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:949) at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817) at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:200) at com.ibm.ws390.xmem.proxy.channel.XMemProxySRInboundConnLink.ready(XMemProxySRInboundConnLink.java:105) at com.ibm.ws390.xmem.proxy.channel.XMemProxySRInboundChannel.processNewConnection(XMemProxySRInboundChannel.java:123) at com.ibm.ws390.xmem.proxy.XMemProxySRCppUtilities.httpinvoke(XMemProxySRCppUtilities.java:150) at com.ibm.ws390.orb.ServerRegionBridge.httpinvoke(ServerRegionBridge.java:213) at com.ibm.ws390.orb.CommonBridge.getAndProcessWork(CommonBridge.java:683) at com.ibm.ws390.orb.CommonBridge.runApplicationThread(CommonBridge.java:614) at com.ibm.ws.util.ThreadPool$ZOSWorker.run(ThreadPool.java:2127) &lt;/Details&gt; &lt;/Throwable&gt; &lt;Request&gt; &lt;Session created=\"true\"&gt; &lt;SessionInfo valid=\"true\" source=\"COOKIE\" id=\"###\" creationTime=\"2018-08-02T07:41:34.359-04:00\" lastAccessedTime=\"2018-08-02T07:41:34.680-04:00\" maxInactiveInterval=\"1800\" new=\"false\"/&gt; &lt;/Session&gt; &lt;Parameters/&gt; &lt;Attributes&gt; &lt;ApplicationScope&gt; &lt;Attribute name=\"com.ibm.websphere.servlet.application.classpath\" value=\"*VALUE REMOVED*\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.websphere.servlet.application.host\" value=\"###\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.websphere.servlet.application.name\" value=\"###\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.websphere.servlet.enterprise.application.name\" value=\"###\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.websphere.servlet.event.ServletContextEventSource\" value=\"com.ibm.ws.webcontainer.webapp.WebAppEventSource@a0f4f3f7\" classType=\"com.ibm.ws.webcontainer.webapp.WebAppEventSource\"/&gt; &lt;Attribute name=\"com.ibm.ws.jsf.JSF_IMPL_ENABLED\" value=\"None\" classType=\"com.ibm.ws.jsf.JSFConstants$JSFImplEnabled\"/&gt; &lt;Attribute name=\"com.ibm.ws.jsp.servletContextListeners.contextInitialized\" value=\"true\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.ws.webcontainer.config.WelcomeFileList\" value=\"\[index.html, index.htm, index.jsp\]\" classType=\"java.util.ArrayList\"/&gt; &lt;Attribute name=\"com.ibm.ws.webcontainer.webAppPmiListener\" value=\"com.ibm.ws.webcontainer.WebAppPmiListener@439c3f08\" classType=\"com.ibm.ws.webcontainer.WebAppPmiListener\"/&gt; &lt;Attribute name=\"com.ibm.wsspi.portletcontainer\" value=\"com.ibm.ws.portletcontainer.pcinvoker.PortletContainerImpl@2a527a26\" classType=\"com.ibm.ws.portletcontainer.pcinvoker.PortletContainerImpl\"/&gt; &lt;Attribute name=\"CONFIGURATION_CONTEXT\" value=\"org.apache.axis2.context.ConfigurationContext@c9df7dbd\" classType=\"org.apache.axis2.context.ConfigurationContext\"/&gt; &lt;Attribute name=\"javax.faces.validator.beanValidator.ValidatorFactory\" value=\"com.ibm.ws.beanvalidation.WASProxyValidatorFactory@1011fd1c\" classType=\"com.ibm.ws.beanvalidation.WASProxyValidatorFactory\"/&gt; &lt;Attribute name=\"javax.servlet.context.tempdir\" value=\"###\" classType=\"java.io.File\"/&gt; &lt;Attribute name=\"JCDI_ENABLED\" value=\"false\" classType=\"java.lang.Boolean\"/&gt; &lt;Attribute name=\"org.apache.jasper.runtime.JspApplicationContextImpl\" value=\"org.apache.jasper.runtime.JspApplicationContextImpl@4ebe686b\" classType=\"org.apache.jasper.runtime.JspApplicationContextImpl\"/&gt; &lt;Attribute name=\"org.apache.wink.server.internal.RequestProcessor\" value=\"org.apache.wink.server.internal.RequestProcessor@fa506c7a\" classType=\"org.apache.wink.server.internal.RequestProcessor\"/&gt; &lt;Attribute name=\"org.springframework.web.context.support.ServletContextScope\" value=\"org.springframework.web.context.support.ServletContextScope@b160b6b9\" classType=\"org.springframework.web.context.support.ServletContextScope\"/&gt; &lt;Attribute name=\"org.springframework.web.context.WebApplicationContext.ROOT\" value=\"Root WebApplicationContext: startup date \[Thu Aug 02 03:20:04 EDT 2018\]; root of context hierarchy\" classType=\"org.springframework.web.context.support.XmlWebApplicationContext\"/&gt; &lt;Attribute name=\"org.springframework.web.servlet.FrameworkServlet.CONTEXT.Spring\" value=\"WebApplicationContext for namespace 'Spring-servlet': startup date \[Thu Aug 02 03:20:26 EDT 2018\]; parent: Root WebApplicationContext\" classType=\"org.springframework.web.context.support.AnnotationConfigWebApplicationContext\"/&gt; &lt;Attribute name=\"###\" value=\"org.apache.wink.server.internal.lifecycle.metadata.EJBMetadata@c7f8ea3b\" classType=\"org.apache.wink.server.internal.lifecycle.metadata.EJBMetadata\"/&gt; &lt;/ApplicationScope&gt; &lt;SessionScope/&gt; &lt;RequestScope&gt; &lt;Attribute name=\"com.aoins.errorhandler.ErrorHandlerAttribute.EH_TIME\" value=\"August 02, 2018 07:41:34 AM\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.aoins.errorhandler.ErrorHandlerAttribute.EH_UUID\" value=\"###\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.servlet.engine.webapp.dispatch_nested\" value=\"true\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"com.ibm.servlet.engine.webapp.dispatch_type\" value=\"forward\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"ErrorReport\" value=\"com.ibm.ws.webcontainer.webapp.WebAppErrorReport: java.lang.IllegalStateException\" classType=\"com.ibm.ws.webcontainer.webapp.WebAppErrorReport\"/&gt; &lt;Attribute name=\"javax.servlet.error.exception\" value=\"java.lang.IllegalStateException\" classType=\"java.lang.IllegalStateException\"/&gt; &lt;Attribute name=\"javax.servlet.error.exception_type\" value=\"class java.lang.IllegalStateException\" classType=\"java.lang.Class\"/&gt; &lt;Attribute name=\"javax.servlet.error.message\" value=\"java.lang.IllegalStateException\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.error.request_uri\" value=\"/V5/Auto/static/css/vehicleLookup.css\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.error.servlet_name\" value=\"Static File wrapper\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.error.status_code\" value=\"500\" classType=\"java.lang.Integer\"/&gt; &lt;Attribute name=\"javax.servlet.forward.context_path\" value=\"###\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.forward.path_info\" value=\"###\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.forward.request_uri\" value=\"/V5/Auto/static/css/vehicleLookup.css\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.forward.servlet_path\" value=\"\" classType=\"java.lang.String\"/&gt; &lt;Attribute name=\"javax.servlet.jsp.jspException\" value=\"com.ibm.ws.webcontainer.webapp.WebAppErrorReport: java.lang.IllegalStateException\" classType=\"com.ibm.ws.webcontainer.webapp.WebAppErrorReport\"/&gt; &lt;/RequestScope&gt; &lt;/Attributes&gt; &lt;Cookies&gt; ### &lt;/Cookies&gt; &lt;Headers&gt; &lt;Header name=\"$WSIS\"&gt; &lt;Value&gt;false&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSPR\"&gt; &lt;Value&gt;HTTP/1.1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSRA\"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSRH\"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSSC\"&gt; &lt;Value&gt;http&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSSN\"&gt; &lt;Value&gt;www.###.com&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSSP\"&gt; &lt;Value&gt;80&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"$WSXCTCONTEXTID\"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"_WS_HAPRT_WLMVERSION\"&gt; &lt;Value&gt;-1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Accept\"&gt; &lt;Value&gt;text/css, */*&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Accept-Language\"&gt; &lt;Value&gt;en-US&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Cookie\"&gt; &lt;Value&gt;*VALUE REMOVED*&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"DNT\"&gt; &lt;Value&gt;1&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Host\"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"If-Modified-Since\"&gt; &lt;Value&gt;Mon, 30 Jul 2018 17:07:34 GMT&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Referer\"&gt; &lt;Value&gt;https://www.google.com&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Surrogate-Capability\"&gt; &lt;Value&gt;WS-ESI=\"ESI/1.0+\"&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"User-Agent\"&gt; &lt;Value&gt;Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"clientip\"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"ssodbg\"&gt; &lt;Value&gt;3&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"TLSLog\"&gt; &lt;Value&gt;TLSv1.2&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"Username\"&gt; &lt;Value&gt;###&lt;/Value&gt; &lt;/Header&gt; &lt;Header name=\"X-Forwarded-Proto\"&gt; &lt;Value&gt;https&lt;/Value&gt; &lt;/Header&gt; &lt;/Headers&gt; &lt;OriginalRequestedURI&gt;###&lt;/OriginalRequestedURI&gt; &lt;RequestedURI&gt;###&lt;/RequestedURI&gt; &lt;OriginalQueryString&gt;null&lt;/OriginalQueryString&gt; &lt;QueryString&gt;null&lt;/QueryString&gt; &lt;ServletName&gt;Static File wrapper&lt;/ServletName&gt; &lt;StatusCode&gt;500&lt;/StatusCode&gt; &lt;CharacterEncoding&gt;null&lt;/CharacterEncoding&gt; &lt;ContentLength&gt;-1&lt;/ContentLength&gt; &lt;ContentType&gt;null&lt;/ContentType&gt; &lt;Secure&gt;true&lt;/Secure&gt; &lt;Method&gt;GET&lt;/Method&gt; &lt;AuthorizationType&gt;BASIC&lt;/AuthorizationType&gt; &lt;PathInfo&gt;null&lt;/PathInfo&gt; &lt;PathTranslated&gt;null&lt;/PathTranslated&gt; &lt;Client host=\"###\" address=\"###\" remoteUser=\"###\" port=\"###\"&gt; &lt;Locale language=\"en\" country=\"US\"/&gt; &lt;/Client&gt; &lt;Server host=\"###\" port=\"###\"/&gt; &lt;WASServer serverName=\"###\" jobNumber=\"###\"/&gt; &lt;LocalInterface host=\"###\" address=\"###0\" port=\"###\"/&gt; &lt;/Request&gt; &lt;/WebError&gt;" | spath </CODE></PRE> Thu, 02 Aug 2018 18:10:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-for-multiple-headers-and-header-values/m-p/383616#M112048 sudosplunk 2018-08-02T18:10:51Z