topic How to extract a sequence from this log with rex command in Splunk Search

How to extract a sequence from this log with rex command

splunk2019tlmd — Wed, 08 Apr 2020 21:30:54 GMT

I have this log :

        <LST>
      <S>Watch</S>
      <S>Move</S>
      <S>Delete</S>
      <S>Flip</S>
    </LST>

And I want to extract this part with rex syntax :

  <S>Watch</S>
      <S>Move</S>
      <S>Delete</S>
      <S>Flip</S>

But I am not having success , I think is because the specials characters.

Thank you in advance

Re: How to extract a sequence from this log with rex command

to4kawa — Wed, 08 Apr 2020 22:10:55 GMT

| rex max_match=0 "(?<attr>\<\w\>\w+\<\/\w\>)"

use \ (back slash)

Re: How to extract a sequence from this log with rex command

splunk2019tlmd — Wed, 08 Apr 2020 22:18:08 GMT

It works but the outputs is one line, in case I want the sequence (Move Delete Flip) ) in one line, I guess I have to replicate the example. Thank you

Re: How to extract a sequence from this log with rex command

to4kawa — Wed, 08 Apr 2020 22:32:47 GMT

 ....
| eval sequence=mvjoin(attr," ")

try this