topic Re: Search And Global Replace Like Function in Splunk ??? in Splunk Search

Search And Global Replace Like Function in Splunk ???

bansi — Fri, 03 Dec 2010 02:52:38 GMT

I have XML log file in following format

<ContractId>true</ContractId><Name name-type="Name">true</Name><IncurredDate>true</IncurredDate>

I would like to search and replace the abov xml entry in the log file to ContractId, Name, IncurredDate

Re: Search And Global Replace Like Function in Splunk ???

ftk — Fri, 03 Dec 2010 04:04:46 GMT

I am not sure what you mean. Can you post an example output you're looking for?

Re: Search And Global Replace Like Function in Splunk ???

southeringtonp — Fri, 03 Dec 2010 04:29:09 GMT

Are you just trying to extract fields?

Have you found the xmlkv command?

In general, the Search Reference and Search Command Cheat Sheet are good places to start.

Update:

Substitution really doesn't seem to be the best approach here. Why not just extract the matches for the beginning of a tag into a new field, then join them back together if you want a single line?

| rex field=_raw max_match=50 "\<(?<keys>[A-Za-z]+)"
| eval keys=mvjoin(keys,",")

If you're really that set on substitution for some reason, I suppose you could do something like:

| eval keys=_raw
| rex field=keys mode=sed "s/<([A-Za-z]+).*?<\/\1>/\1,/g"
| eval keys=substr(keys,1,len(keys)-1)

These are shown pulling from _raw, which is the full event text - if the XML string is already in another field you'll need to adjust for that.

While working with rex, if you need a reference on regular expression syntax, you might want to check
http://www.regular-expressions.info/

Re: Search And Global Replace Like Function in Splunk ???

bansi — Fri, 03 Dec 2010 04:32:44 GMT

I have following entries in Log file

truetruetrue

truetruetrue
I would like to search and extract only the tag names .
For example output should be tag names comma separated

ContractId, Name, IncurredDate
ContractId, Name, Date

My search command replaces only first occurence of so i tried something like rex mode=sed "s/find/replace/g" but even that didnt help
Please let me know the rex command to extract tag names

Re: Search And Global Replace Like Function in Splunk ???

bansi — Fri, 03 Dec 2010 04:43:33 GMT

the following sed command doesnt work
rex mode=sed s/>true./>/,/g
What am i missing?

Re: Search And Global Replace Like Function in Splunk ???

bansi — Fri, 03 Dec 2010 04:58:15 GMT

Yes i tried xmlkv and all other search commands in cheat sheet but nothing fits the bill. Look like i am running out of options.
Each entry in the log file is XML so i have to extract xml node names without worrying about its content all i need is node names.
The xml entry looks like this

truetruetrue

All i need to extract is node names like ContractId, Name, IncurredDate.

Re: Search And Global Replace Like Function in Splunk ???

southeringtonp — Fri, 03 Dec 2010 05:19:50 GMT

Ok. Trying to use substitution to blank out part of the string could work, but sounds like a more complicated approach than you need. Field extraction is likely to be easier. See edits above -- it's similar in principle to your other question at http://answers.splunk.com/questions/9505/filter-search-results

Re: Search And Global Replace Like Function in Splunk ???

bansi — Fri, 03 Dec 2010 05:43:28 GMT

Thanks it works

Re: Search And Global Replace Like Function in Splunk ???

bansi — Sat, 04 Dec 2010 05:43:59 GMT

How would i do the same for values meaning how to extract just the values instead of keys and then comma separate those values

Re: Search And Global Replace Like Function in Splunk ???

bansi — Wed, 22 Dec 2010 03:47:05 GMT

How would i remove duplicate keys in eval keys=mvjoin(keys,",")