Help with regex in transforms

[a212830]

Hi,

I'm hoping that someone can help me with a regex.

Here's the source data:

<OTHERFIELD>some values</OTHERFIELD><COMPID>string1 node 1</COMPID><MOREOTHERFIELDS>more values</MOREOTHERFIELDS>

I need to extract everything between the COMPID brackets. I have the following, but it's grabbing the extra bracket at the end.

REGEX = \<COMPID\>(?<dvcTEST>\w*\s)

I've tried regex101 site, but wasn't able to get it right.

[kmorris_splunk]

Does this do the trick?

(?[\w\s]+)<\/COMPID>

[a212830]

This is in transforms.conf, so where would the field get defined? I tried that, it errors out when restarting the search-head:

REGEX = \<COMPID\>(?[\w\s]+)<\/COMPID>

[jnudell_2 · Accepted solution]

Hi @a212830 ,
I would do this as a one-liner in props.conf:

EXTRACT-compid = \<COMPID\>(?<dvcTEST>[^\<]+)\<\/COMPID\>

But if you REALLY want to do it in props.conf & transforms.conf:
props.conf

REPORT-extractcompid = extractcompid

transforms.conf

[extract_compid]

REGEX = &lt;COMPID&gt;(?<dvcTEST>[^&lt;]+)&lt;\/COMPID&gt;

FORMAT = dvcTEST::$1

[a212830]

Thanks. I like that better. What if I just wanted the first word between the brackets? I have similiar ones where only the first word is needed.

[jnudell_2]

Then you would use a regex match for any non-whitespace character. As an example:
Instead of [^\<]+
Use \S+

[a212830]

Tried this, but it didn't work:

EXTRACT-testcompid = \<COMPID\>(?<testdvc>\S+)\<\/COMPID\>

I'm trying to get the first word between the COMPID brackets.

[wneighbo]

add .*? after your named group or remove <\/COMPID>

[a212830]

So, this? EXTRACT-testcompid = \<COMPID\>(?<testdvc>.*?)\<\/COMPID\>

I tried it in regex101, and it didn't get anything.

[a212830]

Elimnated the COMPID, and it worked. Thanks everyone! Much appreciated.