topic Re: How to extract a string from a particular XML tags with regular expression? in Splunk Search

How to extract a string from a particular XML tags with regular expression?

kirangurram — Mon, 24 Jun 2019 12:47:39 GMT

Dear Experts ,
Need your help with regular expression. I have an XML tag in the field f.
I would like to extract all the characters including spaces (or) Special characters from this XML string <Rmk>.
I tried to use search | rex field=f "\<Rmk\>"(?<Rmk>\w*)"\<\/Rmk\>" , however this regular expression is not giving any output.

your help is much appreciated with this query.

XML Tag :

<Rmk>ABC*/ Work Direct---</Rmk>

Desired Output : ABC*/ Work Direct---

Re: How to extract a string from a particular XML tags with regular expression?

gcusello — Mon, 24 Jun 2019 13:05:10 GMT

Hi kirangurram,
try this regex

\<Rmk\>(?<Rmk>[^\<]*)\<\/Rmk\>

Bye.
Giuseppe

Re: How to extract a string from a particular XML tags with regular expression?

kirangurram — Mon, 24 Jun 2019 13:15:32 GMT

thanks for your help @gcusello . Your solution works.

Re: How to extract a string from a particular XML tags with regular expression?

gcusello — Mon, 24 Jun 2019 14:16:14 GMT

Hi kirangurram,
if you're satisfied of this solution, please accept and/or upvote it.
See next time.
Bye.
Giuseppe

Re: How to extract a string from a particular XML tags with regular expression?

DavidHourani — Mon, 24 Jun 2019 14:24:34 GMT

didn't see you commented there Giuseppe 🙂 deleting my answer 🙂

Re: How to extract a string from a particular XML tags with regular expression?

woodcock — Mon, 24 Jun 2019 14:41:09 GMT

Just add ... | spath input=f, like this:

|makeresults | eval f="<Rmk>ABC*/ Work Direct---</Rmk>"

| spath input=f