topic Re: REX SED Help, need to replace namespaces from xml field in Splunk Search

REX SED Help, need to replace namespaces from xml field

somesoni2 — Mon, 09 Dec 2013 18:30:24 GMT

Hi,

I have a xml field which holds values like below. It contains namespaces for each element which I want to remove:

...message="<h:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<h:Header>
<h:creationTimestamp>2013-12-09T16:58:57.2450018+05:30</h:creationTimestamp>
<h:applicationId>XYZ</h:applicationId>
<h:hostName>Myhost</h:hostName>
</h:Header>
</h:Envelope>"

Obviously there could be more/different namespace values ("h:" prefix) in the the logs, so can't hardcode the value to replace it. I believe REX SED would be the appropriate method for my requirement.

I am very new to Regex so not able to start with REX SED command. Could anyone provide me some direction/example how to go about it?

Re: REX SED Help, need to replace namespaces from xml field

emechler_splunk — Mon, 09 Dec 2013 19:55:23 GMT

If you wanted to do this at index-time (i.e. remove the content from the event before it's indexed into Splunk), then you could use SEDCMD to remove the content via props.conf:

[XML_sourcetype] ... SEDCMD-null = s/(<h:\S+)\s+(xmlns:\S+)(>)/\\1\3/g

If you're doing this inline, then the same regex should work with the rex command:

... | rex field=_raw mode=sed "s/(<h:\S+)\s+(xmlns:\S+)(>)/\1\3/g"

Re: REX SED Help, need to replace namespaces from xml field

somesoni2 — Mon, 09 Dec 2013 20:29:48 GMT

I would like to do this during search time. Unfortunately the above rex command doesn't work for me (event with test data I provided).

Re: REX SED Help, need to replace namespaces from xml field

emechler_splunk — Mon, 09 Dec 2013 21:39:56 GMT

Sorry, looked like there was an extra backslash in the regex. Try the updated version above.

Re: REX SED Help, need to replace namespaces from xml field

somesoni2 — Fri, 20 Dec 2013 19:19:14 GMT

It worked fine and removing all occurrance of xmlns where "<h:" is present. Is is possible to remove the "h:" also so that I will be left with just "" instead of ""

Re: REX SED Help, need to replace namespaces from xml field

emechler_splunk — Mon, 23 Dec 2013 18:43:38 GMT

Sure, simply remove the "h:" from the capture group as such:
"s/(<)h:(\S+)\s+(xmlns:\S+)(>)/\1\2\4/g"

Re: REX SED Help, need to replace namespaces from xml field

Cuyose — Wed, 05 Oct 2016 00:32:33 GMT

Another way you could do this at search time is to simply eval the XML portion with a regex replace

|rex field=_raw "(?i)request=(?.+)$"

|eval requestXML=replace(XML,"\w+:","")

|xmlkv requestXML