https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456218#M168188 <P>Hi, </P> <P>I have a sample log file as shown in the attached screenshot.<BR /> I have many such tags in the log file. I want to extract all time delay tags as a separate filed. It will be a tedious task to write separate regular expression for each tag. Is there any way to extract all the tags with single regular expression ? <BR /> How can i achieve this ?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5417i46E455C75C1EA8BA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 24 Jul 2018 06:10:59 GMT Allampally 2018-07-24T06:10:59Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456218#M168188 <P>Hi, </P> <P>I have a sample log file as shown in the attached screenshot.<BR /> I have many such tags in the log file. I want to extract all time delay tags as a separate filed. It will be a tedious task to write separate regular expression for each tag. Is there any way to extract all the tags with single regular expression ? <BR /> How can i achieve this ?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5417i46E455C75C1EA8BA/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 24 Jul 2018 06:10:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456218#M168188 Allampally 2018-07-24T06:10:59Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456219#M168189 <P>@Allampally <BR /> Instead of screenshot.. Can you kindly post log sample here. </P> Tue, 24 Jul 2018 06:41:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456219#M168189 Shan 2018-07-24T06:41:44Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456220#M168190 <P>@Allampally, If your raw data is xml you can use <CODE>KV_MODE=xml</CODE> in your <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">props.conf</A> to extract all xml nodes at search time field discovery.</P> <P>Alternatively you can can use <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath">spath</A> command with your xml data, which should extract all xml nodes similar to above approach.</P> <PRE><CODE>&lt;yourCurrentSearch&gt; | spath </CODE></PRE> <P>If you need Regex based extraction (Search Time using SPL or Transform) you can refer to the following answer for generic Regular Expression for extracting KV Pair from XML: <A href="https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html">https://answers.splunk.com/answers/2889/automatically-extract-xml-key-value-pairs.html</A></P> Tue, 24 Jul 2018 07:00:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-many-fields-with-a-single-regular-expression/m-p/456220#M168190 niketn 2018-07-24T07:00:17Z