topic Re: Splunk - field extraction in Splunk Search

Splunk - field extraction

chuck_life09 — Tue, 03 Nov 2020 11:36:24 GMT

I need to extract a value from this field and update in my table.

Details.Context = "dgfhgjj <Property Name="Name" VariantType="8">TRIMWorkgroup</Property>"

field_name irrelevant data when Name="Name" i want the result value (TRIMWorkgroup) in this case as my field value in new field name called "Service"

Help me with a rex command for this.

gcusello — Tue, 03 Nov 2020 11:51:29 GMT

let me understand:

when you have Name="Name", you want the string between ">" and "<", if this is your need, please try this:

| rex field=Details.Context "Name\=\"Name\"[^\>]+\>(?<your_field>[^\<]+)"

Ciao.

Giuseppe

chuck_life09 — Tue, 03 Nov 2020 12:00:39 GMT

thank you so much, it worked ...

gcusello — Tue, 03 Nov 2020 12:04:26 GMT

good for you!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉