https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295246#M160352 <P>I tried as well, but not sure on it. here is the sample request, which I am trying to put it on a table (which results with error descp 1, 2 &amp; 3). please advise.</P> Wed, 05 Jul 2017 02:09:25 GMT t964396 2017-07-05T02:09:25Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295240#M160346 <P>Can you please help me on how to write a basic SPLUNK query which returns value A, B, C &amp; D.</P> <P>here are the sample XML tags screenshot attached</P> Tue, 04 Jul 2017 23:51:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295240#M160346 t964396 2017-07-04T23:51:35Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295241#M160347 <P>You're trying to extract these into one field? Or what are you expecting as an output? </P> Wed, 05 Jul 2017 00:15:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295241#M160347 cmerriman 2017-07-05T00:15:42Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295242#M160348 <P>trying to extract this output as a table</P> Wed, 05 Jul 2017 00:17:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295242#M160348 t964396 2017-07-05T00:17:04Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295243#M160349 <P>Try something like this:</P> <PRE><CODE>|rex "one\&gt;(?&lt;one&gt;\w+)|two\&gt;(?&lt;two&gt;\w+)"|table one two </CODE></PRE> <P>The regex should extract what is in the one and two nodes and put them in fields called one and two. </P> Wed, 05 Jul 2017 00:28:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295243#M160349 cmerriman 2017-07-05T00:28:48Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295244#M160350 <P>Thanks!, I tried but still, it returns only A, B.. but not C, D &amp; E, F. </P> Wed, 05 Jul 2017 00:57:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295244#M160350 t964396 2017-07-05T00:57:48Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295245#M160351 <P>wouldn't you want to use xpath or spath to deal with XML?</P> Wed, 05 Jul 2017 01:43:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295245#M160351 cmisztur 2017-07-05T01:43:11Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295246#M160352 <P>I tried as well, but not sure on it. here is the sample request, which I am trying to put it on a table (which results with error descp 1, 2 &amp; 3). please advise.</P> Wed, 05 Jul 2017 02:09:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295246#M160352 t964396 2017-07-05T02:09:25Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295247#M160353 <P>I tried, but not sure on it. So I had written a query using rex as below, it returns only error code1 detail1 all the times.</P> <P>(one = code , two = detail)</P> <P>InterfaceResponse| <BR /> rex "\(?.{2,60})&lt;\/msg:succes" | where success = "false" | <BR /> rex "\(?.{2,60})&lt;\/msg:cod" | <BR /> rex "\(?.{10,60})&lt;\/msg:cod" | <BR /> rex "\(?.{10,60})&lt;\/msg:cod" | <BR /> rex "(?.{2,60})&lt;\/msg:detai" | <BR /> rex "(?.{10,60})&lt;\/msg:detai" |<BR /> rex "(?.{10,60})&lt;\/msg:detai" |<BR /> table MessageUUID success errorcode1 errorcode2 errorcode3 detail1 detail2 detail3</P> Wed, 05 Jul 2017 02:24:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295247#M160353 t964396 2017-07-05T02:24:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295248#M160354 <P>when you tried xpath, what did you try? <CODE>|xpath outfield=one "//msg:XYS/msg:ONE"</CODE></P> Wed, 05 Jul 2017 11:52:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-a-basic-SPLUNK-query-which-returns-value-A-B-C-D/m-p/295248#M160354 cmerriman 2017-07-05T11:52:56Z