topic Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line in Splunk Search

Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

bansi — Tue, 07 Dec 2010 01:10:44 GMT

How to extract values between Elements tag.

  <DataNode node-type="Contract">
            <TransactionAttributes>
                <entry key="CONTRACT_ID">contract2_100</entry>              
            </TransactionAttributes>
            <Elements>
                <ContractId>true</ContractId>
                <DateOfBirth>true</DateOfBirth>
            </Elements>
        </DataNode>
<DataNode roster-type="search" node-type="Roster">
            <TransactionAttributes>
                <entry key="TRAN_ID">001</entry>                
            </TransactionAttributes>
            <Elements>
                <PhoneNo>true</PhoneNo>
                <SNumber>true</SNumber>
            </Elements>
</DataNode>

The following regular expression erroneously extract values apart from Element tags so Please let me know how to restrict it to retrieve values only between tags

rex "(?m)\<Elements>(?<abc>.*)</Elements>"

results in

<ContractId>true</ContractId><Name name-type="Name">true</Name><DateOfBirth>true</DateOfBirth></Elements></DataNode><DataNode ><TransactionAttributes><entry key="CONTRACT_ID">123</entry><entry

whereas the expected results is only between Elements tag i.e.

<ContractId>true</ContractId><Name name-type="Name">true</Name><DateOfBirth>true</DateOfBirth>

Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

ziegfried — Tue, 07 Dec 2010 01:43:33 GMT

The problem is that .* matches greedy and so the matched part ends at the last occurrence of "</Elements>". You can make it work by adding the non-greedy quantifier: .*?

So this regex should work as expected:

rex "(?ms)\<Elements\>(?<abc>.*?)\</Elements\>"

In order to extract all matching parts of the event, you have to add the max_match parameter to the rex command. This instruct Splunk to make the resulting field multi-valued.

rex "(?ms)\<Elements\>(?<abc>.*?)\</Elements\>" max_match=999

Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

bansi — Tue, 07 Dec 2010 02:21:48 GMT

Thank you so much. But it doesn't picks the under different i.e. PhoneNo, SNumber as shown in xml of my earlier posting.

Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

ziegfried — Tue, 07 Dec 2010 02:42:11 GMT

Modified the answer

Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

bansi — Tue, 07 Dec 2010 02:56:54 GMT

Thank you so much once again. I would greatly appreciate if you could point me to good regular expression website specifically the one which helps me in writing fast Splunk queries.

Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

ziegfried — Tue, 07 Dec 2010 03:29:23 GMT

Here are a few links that might be helpful:
http://www.regular-expressions.info/
http://docs.python.org/library/re.html
http://gskinner.com/RegExr/

Re: Help With Regular Expression To Extract Values Between XML Element Tags on Multi-line

bansi — Mon, 28 Sep 2020 09:21:43 GMT

Thank. I need one more help. I am stranded extracting "values" only from below xml

%
MALE
VA

I am expecting regex to give me output of values as: %, MALE, VA

rex "(?ms)<SearchElements>(?.?)</SearchElements>" max_match=999 | rex field=abc max_match=50 "<entry key="."><(?[A-Za-z]+)"| eval keys=mvjoin(keys,",") | table abc

Please take a moment to correct the regex