topic How do I extract xml tag using regex? in Splunk Search

How do I extract xml tag using regex?

merrin — Fri, 16 Mar 2012 16:47:52 GMT

I tried to extract xml tagNames as fields fieldNameStartTag and fieldNameEndTag using the following.

rex field=_raw "<(?.)>([^<]+)</(?.)>"
But it does not extract all tags correctly. For example I have this xml:

abc
xyz

What I'm looking for is fieldNameStartTag and/or fieldNameEndTag to have values "ChildOne" and "ChildTwo". But the regex above gives me values like these:
1. Parent xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.abcd.com"> abc
2. ChildOne>xyz

Any help is appreciated.

Re: How do I extract xml tag using regex?

emechler_splunk — Fri, 16 Mar 2012 18:23:44 GMT

Have you checked out the xmlkv command? This allows you to automatically extract KV pairs from XML formatted data without any regex's:

http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/xmlkv

Re: How do I extract xml tag using regex?

gkanapathy — Fri, 16 Mar 2012 18:46:50 GMT

You should use the spath command, if you're on 4.3 or higher. If you're on older versions, the xmlkv command will also work for you.