All Apps and Add-ons

Qualys App for Splunk Enterprise: How to get rid of HTML tags in Qualys "Solution" field?

muralianup
Communicator

I am using the Qualys App for Splunk Enterprise and there's a lot of HTML tags in the Solution field.

Eg:
<P> , <A Href, <PRE>..etc.

Is there any way to get rid of these?

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

You can use sedcmd in props.conf or rex in search.

sedcmd-htmlaaa = "s/\<P\>//g"   #removes <P>
sedcmd-htmlaab = "s/\<\/P\>//g" #removes</P>

etc.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

You can use sedcmd in props.conf or rex in search.

sedcmd-htmlaaa = "s/\<P\>//g"   #removes <P>
sedcmd-htmlaab = "s/\<\/P\>//g" #removes</P>

etc.

muralianup
Communicator

If its only

&

, its fine. But there're lots of other HTML tags in the field. Are you telling me I may need to add separate SED for each & every HTML tags ?

0 Karma

jkat54
SplunkTrust
SplunkTrust

yes, welcome to data science... you would need a separate sedcmd for each html tag in my opinion.

But perhaps you can use a single regex to remove all markup...

http://lmgtfy.com/?q=regex+to+remove+all+html

The problem with a single sedcmd to remove all is that this:

 <h1>header</h1><div><font="red">body</font></div>

... will become this:

 headerbody

... or perhaps this if you're really good with regex you'll get smart and add special word/character or spaces: (underscores followed by space instead of original tags for example)

_ header_ _ _ body_ _   
0 Karma

muralianup
Communicator

Got it working. Used this SED in the search:

rex field=SOLUTION mode=sed "s/<[^>]*>//g"

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...