https://community.splunk.com/t5/Splunk-Search/How-to-extract-data-from-XML-tags/m-p/624765#M217185 <P>You can try:</P><UL><LI>spath</LI><LI>xpath</LI><LI>xmlkv</LI></UL> Mon, 19 Dec 2022 21:03:37 GMT PickleRick 2022-12-19T21:03:37Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-data-from-XML-tags/m-p/624763#M217182 <P>Looking for help extracting Info between XML tags. This is generated from windows Print server event logs. the raw data looks like this:</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'&gt;&lt;System&gt;&lt;Provider Name='Microsoft-Windows-PrintService' Guid='{747EF6FD-E535-4D16-B510-42C90F6873A1}'/&gt;&lt;EventID&gt;307&lt;/EventID&gt;&lt;Version&gt;0&lt;/Version&gt;&lt;Level&gt;4&lt;/Level&gt;&lt;Task&gt;26&lt;/Task&gt;&lt;Opcode&gt;11&lt;/Opcode&gt;&lt;Keywords&gt;0x4000000000000840&lt;/Keywords&gt;&lt;TimeCreated SystemTime='2022-12-19T20:07:42.882389000Z'/&gt;&lt;EventRecordID&gt;Record_ID&lt;/EventRecordID&gt;&lt;Correlation/&gt;&lt;Execution ProcessID='procID' ThreadID='threadID'/&gt;&lt;Channel&gt;Microsoft-Windows-PrintService/Operational&lt;/Channel&gt;&lt;Computer&gt;User's computer&lt;/Computer&gt;&lt;Security UserID='SID'/&gt;&lt;/System&gt;&lt;UserData&gt;&lt;DocumentPrinted xmlns='http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events'&gt;&lt;Param1&gt;216&lt;/Param1&gt;&lt;Param2&gt;Print Document&lt;/Param2&gt;&lt;Param3&gt;Username&lt;/Param3&gt;&lt;Param4&gt;Users_computer&lt;/Param4&gt;&lt;Param5&gt;Print Share Name&lt;/Param5&gt;&lt;Param6&gt;printer_name&lt;/Param6&gt;&lt;Param7&gt;1406204&lt;/Param7&gt;&lt;Param8&gt;1&lt;/Param8&gt;&lt;/DocumentPrinted&gt;&lt;/UserData&gt;&lt;/Event&gt;</LI-CODE><P>&nbsp;</P><P><SPAN class=""><BR /></SPAN>How do extract Peram3 and Peram5?&nbsp;<BR />I have attempted using this regular expression, but it fails to find it</P><P>&nbsp;</P><LI-CODE lang="markup"> | regex _raw ="&lt;Param3&gt;.*?&lt;\/Param3&gt;"</LI-CODE><P>&nbsp;</P> Mon, 19 Dec 2022 20:49:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-data-from-XML-tags/m-p/624763#M217182 mhirt34 2022-12-19T20:49:34Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-data-from-XML-tags/m-p/624765#M217185 <P>You can try:</P><UL><LI>spath</LI><LI>xpath</LI><LI>xmlkv</LI></UL> Mon, 19 Dec 2022 21:03:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-data-from-XML-tags/m-p/624765#M217185 PickleRick 2022-12-19T21:03:37Z