Multivalue XML extraction not working

responsys_cm — Sun, 01 Jul 2012 00:16:42 GMT

I'm trying to add several lines of XML to a multi-valued field. The data looks like:

My transforms.conf looks like:

[qualys_exploit]

REGEX = (?mis)(<EXPLT>.*</EXPLT>)

FORMAT = qualys_exploit::$1

MV_ADD = true

props.conf:

REPORT-qualys_exploit = qualys_exploit

Splunk is taking everything between the first opening EXPLT tag and last closing EXPLT tag and making it a single event. What am I doing wrong that it's not treating these as multiple individual events?

Thx.

Re: Multivalue XML extraction not working

andreas — Wed, 18 Jul 2012 10:21:39 GMT

The quantifier * in the REGEX is greedy, so the expression . * is eating up all the chars before the last </EXPLT>
Try adding a ? after the * to make it non-greedy, so the regex "stops" at the next </EXPLT>, not the last.

REGEX = (?mis)(<EXPLT>.*?</EXPLT>)

topic Re: Multivalue XML extraction not working in Splunk Search

Multivalue XML extraction not working

Re: Multivalue XML extraction not working