https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472136#M132847 <P>SPLUNKXML should be extracted automatically by splunk . If not use rex: | rex field=_raw "SPLUNKXML=(?.*), IPCODE"</P> <P>Sample query:</P> <PRE><CODE>| makeresults | eval _raw="2020-02-13 01:04:18.910, COUNT='863132', URL='http://122.32.10:8080/HP/Material', SAD='GET', SPLUNKXML='&lt;APICALL&gt;&lt;IPCODE&gt;201&lt;/IPCODE&gt;&lt;returnTime&gt;1581573606000&lt;/returnTime&gt;&lt;data&gt;&lt;ULID&gt;049726&lt;/ULID&gt;&lt;requestId&gt;$658262&lt;/requestId&gt;&lt;currentStatus&gt;SPlunk - Picked&lt;/currentStatus&gt;&lt;pickedQuantity&gt;&lt;value&gt;634&lt;/value&gt;&lt;uom&gt;EA&lt;/uom&gt;&lt;lastUpdateTime&gt;1581399738000&lt;/lastUpdateTime&gt;&lt;/data&gt;&lt;/APICALL&gt;', IPCODE='111', Timestamp='2020-02-13 01:00:06.75'" | rex field=_raw "SPLUNKXML=(?&lt;SPLUNKXML&gt;.*), IPCODE" </CODE></PRE> Fri, 14 Feb 2020 10:20:30 GMT manjunathmeti 2020-02-14T10:20:30Z https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472135#M132846 <P>I need to filter the data from below _raw only the SPLUNKXML =""</P> <PRE><CODE>_raw 2020-02-13 01:04:18.910, COUNT="863132", URL="http://122.32.10:8080/HP/Material", SAD="GET", SPLUNKXML="&lt;APICALL&gt;&lt;IPCODE&gt;201&lt;/IPCODE&gt;&lt;returnTime&gt;1581573606000&lt;/returnTime&gt;&lt;data&gt;&lt;ULID&gt;049726&lt;/ULID&gt;&lt;requestId&gt;$658262&lt;/requestId&gt;&lt;currentStatus&gt;SPlunk - Picked&lt;/currentStatus&gt;&lt;pickedQuantity&gt;&lt;value&gt;634&lt;/value&gt;&lt;uom&gt;EA&lt;/uom&gt;&lt;lastUpdateTime&gt;1581399738000&lt;/lastUpdateTime&gt;&lt;/data&gt;&lt;/APICALL&gt;", IPCODE="111", Timestamp="2020-02-13 01:00:06.75" </CODE></PRE> <P>OUtput needed: </P> <PRE><CODE> SPLUNKXML= "&lt;APICALL&gt;&lt;IPCODE&gt;201&lt;/IPCODE&gt;&lt;returnTime&gt;1581573606000&lt;/returnTime&gt;&lt;data&gt;&lt;ULID&gt;049726&lt;/ULID&gt;&lt;requestId&gt;$658262&lt;/requestId&gt;&lt;currentStatus&gt;SPlunk - Picked&lt;/currentStatus&gt;&lt;pickedQuantity&gt;&lt;value&gt;634&lt;/value&gt;&lt;uom&gt;EA&lt;/uom&gt;&lt;lastUpdateTime&gt;1581399738000&lt;/lastUpdateTime&gt;&lt;/data&gt;&lt;/APICALL&gt;" </CODE></PRE> Fri, 14 Feb 2020 09:53:19 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472135#M132846 DataOrg 2020-02-14T09:53:19Z https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472136#M132847 <P>SPLUNKXML should be extracted automatically by splunk . If not use rex: | rex field=_raw "SPLUNKXML=(?.*), IPCODE"</P> <P>Sample query:</P> <PRE><CODE>| makeresults | eval _raw="2020-02-13 01:04:18.910, COUNT='863132', URL='http://122.32.10:8080/HP/Material', SAD='GET', SPLUNKXML='&lt;APICALL&gt;&lt;IPCODE&gt;201&lt;/IPCODE&gt;&lt;returnTime&gt;1581573606000&lt;/returnTime&gt;&lt;data&gt;&lt;ULID&gt;049726&lt;/ULID&gt;&lt;requestId&gt;$658262&lt;/requestId&gt;&lt;currentStatus&gt;SPlunk - Picked&lt;/currentStatus&gt;&lt;pickedQuantity&gt;&lt;value&gt;634&lt;/value&gt;&lt;uom&gt;EA&lt;/uom&gt;&lt;lastUpdateTime&gt;1581399738000&lt;/lastUpdateTime&gt;&lt;/data&gt;&lt;/APICALL&gt;', IPCODE='111', Timestamp='2020-02-13 01:00:06.75'" | rex field=_raw "SPLUNKXML=(?&lt;SPLUNKXML&gt;.*), IPCODE" </CODE></PRE> Fri, 14 Feb 2020 10:20:30 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472136#M132847 manjunathmeti 2020-02-14T10:20:30Z https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472137#M132848 <PRE><CODE>| makeresults | eval _raw="2020-02-13 01:04:18.910, COUNT='863132', URL='http://122.32.10:8080/HP/Material', SAD='GET', SPLUNKXML='&lt;APICALL&gt;&lt;IPCODE&gt;201&lt;/IPCODE&gt;&lt;returnTime&gt;1581573606000&lt;/returnTime&gt;&lt;data&gt;&lt;ULID&gt;049726&lt;/ULID&gt;&lt;requestId&gt;$658262&lt;/requestId&gt;&lt;currentStatus&gt;SPlunk - Picked&lt;/currentStatus&gt;&lt;pickedQuantity&gt;&lt;value&gt;634&lt;/value&gt;&lt;uom&gt;EA&lt;/uom&gt;&lt;lastUpdateTime&gt;1581399738000&lt;/lastUpdateTime&gt;&lt;/data&gt;&lt;/APICALL&gt;', IPCODE='111', Timestamp='2020-02-13 01:00:06.75'" | kv | foreach * [eval &lt;&lt;FIELD&gt;&gt; = trim('&lt;&lt;FIELD&gt;&gt;', "\'")] </CODE></PRE> <P>@manjunathmeti @premranjithj<BR /> If you use <CODE>spath</CODE> later, the query is here.</P> Sat, 15 Feb 2020 00:58:00 GMT https://community.splunk.com/t5/Splunk-Search/Need-help-in-regular-expression-to-extract-data/m-p/472137#M132848 to4kawa 2020-02-15T00:58:00Z